{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e5a98585-d04e-569f-a486-8d6b2692904c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6", "version": "5.1.20.RELEASE-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0d55d6ec-cf43-5ac4-81f0-253bcff7ce26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:f02e4490-1e1d-50f8-abf9-2921d112bd69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5421 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:04bef8e7-7a62-5c16-892f-13f4b5244688", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:48f82cea-8294-538f-a029-f264d18399fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22118 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ea2298e3-a890-5d46-9010-e8d572287525", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0153623d-6fe6-5ef9-af9f-57d6cefb6841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:cdcdf103-b4db-5323-87c1-a14f04c1b1c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:939203f7-3e7a-5b58-9712-ae428f6be0d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b1f81678-59af-5a41-a450-8a0a636a2351", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:4f7dc51d-8de4-5575-a7a6-974a925bfcca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:bccc6712-2647-5da9-aa03-3aa3d824e7ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:4c26f2d7-ad76-56f4-9063-dd6b0a4aafdd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:5101f949-afa0-54d2-855e-4bb8e02edc58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1548365f-e2ec-5440-9a63-455661e633ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:109ec6ec-ac4c-5bac-be37-aeed237ff5be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:2f1769b2-0a4d-54c6-907f-c2fb98c2ba6f", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-expression 5.1.20.RELEASE-tuxcare.6." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:bd6c7773-f9ac-5c17-b9af-3610a114838d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ab56b4b7-50a1-57dd-8b35-4b24e01003bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:5457125d-d7f6-5108-84b3-51adfbceb7a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:33bfb54f-bf30-58eb-847a-7c85ee6babcc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:493f27fd-f02b-5090-8d1b-89191870ada1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d004e49c-e546-539f-87d8-89b1a1a36383", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d208f9c4-05cb-5908-86be-1cfa4ff7b24e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:32208e34-a00e-5594-8e59-a05d5690baac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:840d1d45-f8de-5998-803f-426b97115208", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ed5de4d6-16ac-5353-9649-1a72c4331278", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:05efc1b8-fde0-5304-8e2c-f7add05cab63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:2c500867-e326-53a1-a039-d247611cff4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d59b78bd-8583-5953-ad40-cc94bd83906d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e726d4fc-081d-581e-8f96-f7f1176ae4d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:587c73c2-a8a0-5993-af4d-10334b10a7b5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library).", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:79efb100-270a-5a12-9dae-e87c072ec72e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e33cbf98-32e7-5e67-81e4-228601e45be4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c27592d2-6e5d-5bb7-b8cc-fb4646220726", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:f027542f-4b68-560b-8aeb-aee0ed2c4a24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:2de713f8-78a0-57fc-8735-4a14ef1a8ddb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:bed7f7bd-b23b-5a76-add9-6a63e30d0bed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:664f8931-c344-5ea2-a236-b244ed0cf49c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression. Spring Framework 5.1.20.RELEASE is outside the CVE-2026-41847 affected range of 5.3.0 through 5.3.48 and predates the vulnerable RouterFunctionDsl.filter API." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:6973cf1f-18d6-5a8e-bd5e-0326f957a4e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:2773c712-05d5-5062-ace5-0eb96b2d8203", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9b968e41-ceec-5d1f-9269-c3a5f978d8d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9dcdbdba-58a3-5a36-a89e-71d3fbb2bf80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7864d2b2-abba-5b0d-8a0d-32d0927cfc97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:8b04c41f-7b8d-5eed-bdc8-fcf3e98d11a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:429b6b02-48b9-5f14-a112-bbec8c0031d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:5f6e585d-3953-5300-b339-b3d4e24a5638", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3ded3fb7-a0b8-5260-8719-526d69505d99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:481ab786-7b7e-5184-b5e3-510d1770a5d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c8446047-a9f8-529c-84c0-152ecb86364e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:5261cf16-4c2a-5bda-b339-3c6651986467", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:8fda009e-49be-5ea1-8ac9-03f1bc353e8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:19e6271f-45e5-5878-a376-06082e109030", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:8f9188c1-783b-5d06-bf16-d28a64624f1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:fd331c6d-2ba5-5539-933b-2a2c7799e68a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:59d3bafe-bdb7-5396-8808-d4b5abee302e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:229c9423-9c30-5331-8882-06eb5865807d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.6" } ] }