{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6a769808-fd8c-530c-a634-71be35f61c56", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1", "version": "5.3.33-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.3.33", "type": "library", "group": "org.springframework", "version": "5.3.33" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:f134d599-73f3-5c1e-878f-ffcaca69df0f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22950 does not affect version 5.3.33-tuxcare.1 of org.springframework:spring-expression. not_affected \u2014 CVE-2022-22950 is NOT present in Spring Framework 5.3.33. The vulnerability affects versions 5.3.0-5.3.16, and the fix was introduced in upstream version 5.3.17 (commit 83ac659158). The target version 5.3.33 already contains the upstream fix that limits array element creation to 256K elements, preventing the DoS condition. The fix was shipped in the upstream release when TuxCare onboarded versi...", "justification": "code_not_present" } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:a77b9dbd-86e2-51bd-8565-24e85ba74e9b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20861 does not affect version 5.3.33-tuxcare.1 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20861 affects Spring Framework versions 5.3.0-5.3.25 due to insufficient regex pattern caching in the SpEL matches operator, which could cause DoS through repeated pattern compilation. The target version 5.3.33 is NOT vulnerable because the fix (commit 430fc25aca by Sam Brannen) was already present in the upstream Spring Framework 5.3.26 release. The fix moves the pattern cache from in...", "justification": "code_not_present" } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:035afcf4-97dc-5e18-93be-1888f4b211f5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20863 does not affect version 5.3.33-tuxcare.1 of org.springframework:spring-expression. not_affected \u2014 Target version 5.3.33 is not affected by CVE-2023-20863. The upstream Spring Framework fix for SpEL expression length limiting (restricting expressions to 10,000 characters) was already present in the upstream 5.3.33 release when TuxCare onboarded it. The CVE affects versions prior to 5.2.24, 5.3.27, and 6.0.8; since 5.3.33 > 5.3.27, the fix was already incorporated upstream. The fix commit (eb...", "justification": "code_not_present" } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:e9606a6d-8530-5c70-b20d-45dfd50058bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression, and is fixed in 5.3.33-tuxcare.5." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:46866054-7cb5-500e-ae46-d7cd2964be18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression, and is fixed in 5.3.33-tuxcare.5." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:9d992536-34da-5ae5-a767-534518555c32", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression, and is fixed in 5.3.33-tuxcare.4." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:8c877fa3-6556-5a02-b410-abe2ad3bd42e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression, and is fixed in 5.3.33-tuxcare.3." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:f1d0b3c3-9162-5fa2-b154-2e12495bb602", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:68e10611-1635-5313-96a1-43243f50abbc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:0b505071-dba5-5da3-9707-91559e56ddcf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ] }