{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:88298e18-b2dd-5d2e-b835-90f28a2a5212", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7", "type": "library", "group": "org.springframework", "name": "spring-expression", "version": "4.3.30.RELEASE-tuxcare.7", "purl": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:3b464d52-7332-5503-95b2-a58b63931e09", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:36c98d68-8481-5fcf-8121-9ee0c8c1dd8d", "id": "CVE-2020-5397", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:6b3bd7fc-e68d-58b8-b71f-c3ac96ed3bed", "id": "CVE-2020-5421", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression. Version 4.3.30.RELEASE is not affected by CVE-2020-5421: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 6327c60912cd80120040c8c16c3731d8bf6c19f6\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:0fd09102-d2ab-5235-a271-fc98184bd45b", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c03f033d-a4d7-5e8c-8585-bb724919bff9", "id": "CVE-2021-22096", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:84c26bd8-4a3e-5c55-bb12-7327f5f3e575", "id": "CVE-2021-22118", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression. Version 4.3.30.RELEASE is not vulnerable. Summary: Target repository is Spring Framework 4.3.30.RELEASE-tuxcare.2, which predates the introduction of WebFlux. The vulnerable code (reactive multipart handling with predictable temp directories) does not exist in this version. CVE-2021-22118 specifically affects WebFlux applications in Spring Framework 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. WebFlux was introduced in Spring Framework 5.0, and the vulnerable multipart han [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:ed23ee5d-796a-56f7-a357-3b866f037fad", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:b3c22d06-d4fe-57f9-b423-6fe04c5dbdec", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:b57482cc-5d77-5750-87bd-d53044935075", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:944db357-37fb-5742-916a-fe87654425ff", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:63c0c8fb-d6df-5d86-895a-0223fccbbcd8", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:9c8ac5ce-4364-5908-9ae5-42944ccb0416", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:039e51dd-659d-5088-ae2f-05fd55f1c9fc", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:e899cd11-fa93-5775-aeac-ae4d3dac9053", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:025be87f-7981-5a2e-bdbe-a405b3ace698", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:ab25312b-a905-5198-a4bb-4746f185789c", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c7ec3a5b-e88d-57df-8861-10eca2414d54", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:110cb2b6-8725-5a79-a8aa-816d61894867", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:2eea5cd6-53ae-5161-82b2-cfb8cc195b36", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:60b61a7e-a87e-5ffe-a73e-0452c1a7a54f", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:f86a0801-a8bb-587a-8710-15f45ae21276", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:2caa5890-3de5-58b7-8454-ba2477c69f2a", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:a144fe98-60cd-5f87-919e-f557f00efae0", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:8bca2ea7-84c7-52b2-84a1-8715d212d900", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:79d811ea-d72b-514c-89af-f119ed462862", "id": "CVE-2026-22735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22735 affects version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:d5a55783-7875-5b8e-9444-50fe7eca5f51", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:81649cd6-0354-5936-89c6-9770ad09945f", "id": "CVE-2026-22740", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 4.3.30.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 4.x is not in the affected range." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:4911bc8d-cef4-5bdf-ba8d-9d569ccd42c8", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:3481627f-a964-54fc-9d82-0290fed34b5b", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:fbf9361f-a795-5b1d-a4a8-99f1c4b7ec18", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:b2d2e44f-2d83-5594-b2a9-671114a3503d", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:6ef8650d-820b-5a00-ba6d-377399bf8d59", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:5fa8ed14-9de9-5127-b4a0-019253ac1105", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:eba33d62-50b0-51ee-a8c6-ba0af1d4abc1", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:64e5372c-f3a0-52c2-a79d-6debe07ce82a", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:4fd1651f-e190-52b7-8dae-76442682fe7b", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:d68acac4-f2eb-5a10-bec1-295174a0eb5e", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:cf321ca5-df83-5d65-b9d9-b380224599f8", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:b547c1ed-4995-594d-978f-f0f386732d82", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:f98ad329-4eae-5f9b-8c25-9c6aca635e0c", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:5507bdf0-81c2-5308-9101-df8b1c62776f", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:7c6ecc97-8613-544e-af73-de311b4d13e8", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 4.3.30 is not affected by CVE-2026-41853. This version predates Spring WebFlux (introduced in 5.0) and lacks the vulnerable component DefaultServerWebExchange.java. The vulnerability mechanism - Spring Framework's message reader selection based on wildcard Content-Type headers - does not exist in this servlet-based Spring MVC architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:15fa9f27-c0c9-5d7c-8b1c-ffc1262108ec", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:c73cc77f-2f75-5342-8ea5-d38a13ad32ce", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:ab39627c-0d15-55e3-bb83-e676dab42c03", "id": "CVE-2026-47884", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:8939fc74-134a-5ffa-876e-92c07eed8b89", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:e49c9b69-c5fc-5d0d-8215-8c656ace10ed", "id": "CVE-2026-47887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:56f5d7c6-0c95-5b3c-ba5e-93cf24ce5120", "id": "CVE-2026-59280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:d6489aff-9200-5bc9-bbe0-2e933b5d0374", "id": "CVE-2026-59281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:fa69c1e4-c4f1-5e93-be50-8fc3d410a6d2", "id": "CVE-2026-59282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:b764197b-918a-53de-bf39-9c98f6b4b98d", "id": "CVE-2026-59283", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }, { "bom-ref": "urn:uuid:7a0f7588-9e20-59d3-ba42-3ea85a12bfca", "id": "CVE-2026-59314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 4.3.30.RELEASE-tuxcare.7 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.7" } ] }