{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:811ffea2-467f-50a4-9b70-d3863cda935e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@6.1.21-tuxcare.15", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@6.1.21-tuxcare.15", "version": "6.1.21-tuxcare.15", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@6.1.21", "type": "library", "group": "org.springframework", "version": "6.1.21" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:bfad7249-a8e6-549e-aac7-643f91d6be6c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22950 does not affect version 6.1.21-tuxcare.15 of org.springframework:spring-expression. not_affected \u2014 CVE-2022-22950 is not present in Spring Framework 6.1.21. The fix (MAX_ARRAY_ELEMENTS validation to prevent DoS via large array allocation in SpEL expressions) was introduced by upstream commit 83ac6591 (Sam Brannen, 2022-03-08) and was already included in the Spring Framework 6.1.21 release before TuxCare onboarding. The vulnerable pattern - unchecked array dimension values leading to resource...", "justification": "code_not_present" } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:356397fc-0e7e-5289-be0b-65edf59b832d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20861 does not affect version 6.1.21-tuxcare.15 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20861 affects Spring Framework 6.0.0-6.0.6, 5.3.0-5.3.25, and older versions due to a DoS vulnerability in SpEL expression evaluation. The vulnerability stems from per-instance regex pattern caching in OperatorMatches, allowing attackers to cause resource exhaustion through redundant pattern compilation. The target version 6.1.21-tuxcare.16 is NOT AFFECTED because the upstream fix (com...", "justification": "code_not_present" } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:c2ae1bfa-6c30-5dc9-b4fa-7c2eb741ac0b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20863 does not affect version 6.1.21-tuxcare.15 of org.springframework:spring-expression. not_affected \u2014 The target (Spring Framework 6.1.21) is not affected by CVE-2023-20863. The vulnerability was fixed by the upstream Spring Framework team in commit b73f5fcac2 (April 2023) and included in the upstream 6.1.21 release before TuxCare onboarding. The fix adds length validation that rejects SpEL expressions exceeding 10,000 characters, preventing DoS via excessively long expressions. The target impl...", "justification": "code_not_present" } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:27695afa-eec6-5f9c-ab1f-5cf95c753c15", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38808 does not affect version 6.1.21-tuxcare.15 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 6.1.21-tuxcare.16 is NOT AFFECTED by CVE-2024-38808. The vulnerability affects versions 5.3.0-5.3.38 and older. The target version 6.1.21 already contains both upstream fixes (commits e74406afd0 and 0127de5a7a by Sam Brannen) that were shipped in the upstream release before TuxCare onboarded this version. All defense mechanisms are verified present: EvaluationContext.isAssignme...", "justification": "code_not_present" } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:bce40333-4eec-5433-b4e7-18df9945c4f4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 6.1.21-tuxcare.15 of org.springframework:spring-expression. Spring Framework 6.1.21 builds repeated text with the JDK's String.repeat. If the int size check in OpMultiply overflows, String.repeat rejects the request with an OutOfMemoryError before allocating any memory, so the CVE-2026-41849 denial of service cannot occur. The vendor lists only 5.3.x as affected.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:c2ee1c4e-2f5b-510c-a996-8b755b4c8db5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.21-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:b9affc54-2de6-5c7e-89c4-6fd50ec2f51f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.21-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:8a6c0279-0114-53f4-991f-0eb20726b1ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.21-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:38a1374c-3323-5649-9d3d-92e141f4225c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.21-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.21-tuxcare.15" } ], "bom-ref": "urn:uuid:43c2c33d-a2d3-5b82-8bef-97604717188f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.21-tuxcare.15 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.21-tuxcare.15" } ] }