{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e99e59cf-e362-5b52-ac92-c2db07368809", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@6.0.15-tuxcare.4", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@6.0.15-tuxcare.4", "version": "6.0.15-tuxcare.4", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@6.0.15", "type": "library", "group": "org.springframework", "version": "6.0.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:64193024-6de7-5030-8097-8c62def5bd4a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22950 does not affect version 6.0.15-tuxcare.4 of org.springframework:spring-expression. not_affected \u2014 CVE-2022-22950 is not present in Spring Framework 6.0.15. The vulnerability involved SpEL expressions with array constructors that could allocate extremely large arrays causing memory exhaustion (DoS). The upstream fix (adding MAX_ARRAY_ELEMENTS limit and checkNumElements() validation) was introduced by Sam Brannen in commit 83ac659158 and was already included in the Spring Framework 6.0.15 rel...", "justification": "code_not_present" } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:f7a1be00-a497-5c43-a6ef-22b646c6ff33", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20861 does not affect version 6.0.15-tuxcare.4 of org.springframework:spring-expression. not_affected \u2014 The target Spring Framework 6.0.15 is NOT vulnerable to CVE-2023-20861. The vulnerability (DoS via redundant regex pattern compilation in SpEL matches operator) affects versions 6.0.0-6.0.6. The fix was applied in upstream Spring Framework 6.0.7 by commit 935c29e3ddba5b19951e54f6685c70ed45d9cbe5 (Sam Brannen). The target version 6.0.15 inherited this fix from the upstream release. The vulnerabl...", "justification": "code_not_present" } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:bd85411e-6f5b-5752-ba15-f8b15a8489b7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20863 does not affect version 6.0.15-tuxcare.4 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20863 does NOT affect Spring Framework 6.0.15. The vulnerability (DoS via unbounded SpEL expression length) was fixed upstream in Spring Framework 6.0.8, and version 6.0.15 inherited this fix. The target contains the complete defense: InternalSpelExpressionParser.doParseExpression() calls checkExpressionLength() which enforces a 10,000-character limit (DEFAULT_MAX_EXPRESSION_LENGTH in ...", "justification": "code_not_present" } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:87efb7cf-6c67-5b89-9e35-8c8a9e85e7e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 6.0.15-tuxcare.4 of org.springframework:spring-expression, and is fixed in 6.0.15-tuxcare.6." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:a97cfcf8-53c6-5055-82ce-8163939f73e5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 6.0.15-tuxcare.4 of org.springframework:spring-expression. Spring Framework 6.0.15 builds repeated text with the JDK's String.repeat. If the int size check in OpMultiply overflows, String.repeat rejects the request with an OutOfMemoryError before allocating any memory, so the CVE-2026-41849 denial of service cannot occur. The vendor lists only 5.3.x as affected.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:a431225e-f662-5c3a-815b-96d5103ac51e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.15-tuxcare.4 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:c3ed22cf-0457-5b56-bc50-eaf16d10e78d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 6.0.15-tuxcare.4 of org.springframework:spring-expression, and is fixed in 6.0.15-tuxcare.5." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:9c35980c-644a-53d5-af1d-9035a27826a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.15-tuxcare.4 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:d7ea8706-5289-583f-bae8-03937c99d3b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.15-tuxcare.4 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.15-tuxcare.4" } ], "bom-ref": "urn:uuid:163bb849-bfa6-504f-8baa-44b870d4f8f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.15-tuxcare.4 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.15-tuxcare.4" } ] }