{"id":"CVE-2023-20863","aliases":["CLSA-2025-1756771563","CLSA-2025-1760313981","CLSA-2025-1760313986","CLSA-2025-1762906008","CLSA-2026-1776040412","CLSA-2026-1777250292","CLSA-2026-1777250295","CLSA-2026-1777336766","CLSA-2026-1777509606","CLSA-2026-1777855419","CLSA-2026-1777941826","CLSA-2026-1781744126","CLSA-2026-1781744127","CLSA-2026-1782867606","CLSA-2026-1785030424","CLSA-2026-1785204448","CLSA-2026-1785380133","CLSA-2026-1785380233","CLSA-2026-1785380498","CLSA-2026-1785814744","CLSA-2026-1785815205","CLSA-2026-1786609560","CLSA-2026-1788360559","CLSA-2026-1788361406","CLSA-2026-1789427454","CLSA-2026-1790071189","CLSA-2026-1790074384","CLSA-2026-1790102819","CLSA-2026-1790123797","CLSA-2026-1791218487","CLSA-2026-1791289094","CLSA-2026-1791463819","CLSA-2026-1792590655","CLSA-2026-1792590787","CLSA-2026-1793098737","CLSA-2026-1793615375","CLSA-2026-1793615948","CLSA-2026-1793616969","CLSA-2026-1793620971","CLSA-2026-1793625740","CLSA-2026-1793881017","CLSA-2026-1793881978","CLSA-2026-1793883499","CLSA-2026-1793885497","CLSA-2026-1793897029","CLSA-2026-1794157893","DEBIAN-CVE-2023-20863","EUVD-2023-1417","GHSA-wxqc-pxw9-g2p8","RHLW-2026-25544e781d50b856","ROOT-APP-MAVEN-CVE-2023-20863","UBUNTU-CVE-2023-20863"],"status":"published","title":"Spring Framework vulnerable to denial of service","description":"In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01122,"percentile":0.6663,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770","CWE-917"],"published":"2023-04-13T00:00:00Z","modified":"2026-11-11T01:43:17Z","fixes":[{"ecosystem":"Maven","package":"org.springframework:spring-expression","fixed_in":["6.0.8","5.3.27","5.2.24.RELEASE"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","fixed_in":["5.3.24-tuxcare.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.springframework:spring-expression","fixed_in":["5.3.14-aikido.4","5.3.14-aikido.1","5.3.14-aikido.2","5.3.20-aikido.4","5.3.14-aikido.3","5.3.20-aikido.5","5.3.20-aikido.6","5.3.14-aikido.5","4.0.3.RELEASE-aikido.1","4.0.3.RELEASE-aikido.2","5.3.14-aikido.6","4.0.3.RELEASE-aikido.3","4.0.3.RELEASE-aikido.4","5.3.20-aikido.7","5.3.14-aikido.7","4.0.3.RELEASE-aikido.5","4.0.3.RELEASE-aikido.6","5.3.20-aikido.8","5.3.14-aikido.8","4.0.3.RELEASE-aikido.7","4.0.3.RELEASE-aikido.8","5.3.27-aikido.2","5.3.27-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.springframework:spring-expression","fixed_in":["5.3.14-root.io.4","5.3.14-root.io.1","5.3.14-root.io.2","5.3.20-root.io.4","5.3.14-root.io.3","5.3.20-root.io.5","5.3.20-root.io.6","5.3.14-root.io.5","4.0.3.RELEASE-root.io.1","4.0.3.RELEASE-root.io.2","5.3.14-root.io.6","4.0.3.RELEASE-root.io.3","4.0.3.RELEASE-root.io.4","5.3.20-root.io.7","5.3.14-root.io.7","4.0.3.RELEASE-root.io.5","4.0.3.RELEASE-root.io.6","5.3.20-root.io.8","5.3.14-root.io.8","4.0.3.RELEASE-root.io.7","4.0.3.RELEASE-root.io.8","5.3.27-root.io.2","5.3.27-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"fixed":"5.3.27"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.24.RELEASE"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.30.RELEASE"},{"fixed":"4.3.30.RELEASE-tuxcare.1"}]}],"versions":["4.3.30.RELEASE"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.30.RELEASE"},{"fixed":"4.3.30.RELEASE-tuxcare.1"}]}],"versions":["4.3.30.RELEASE"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.30.RELEASE"},{"fixed":"4.3.30.RELEASE-tuxcare.1"}]}],"versions":["4.3.30.RELEASE"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.30.RELEASE"},{"fixed":"4.3.30.RELEASE-tuxcare.1"}]}],"versions":["4.3.30.RELEASE"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.30.RELEASE"},{"fixed":"4.3.30.RELEASE-tuxcare.1"}]}],"versions":["4.3.30.RELEASE"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.30.RELEASE"},{"fixed":"4.3.30.RELEASE-tuxcare.1"}]}],"versions":["4.3.30.RELEASE"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.1"}]}],"versions":["4.0.0.RELEASE"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.1"}]}],"versions":["4.0.0.RELEASE"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.1"}]}],"versions":["4.0.0.RELEASE"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.1"}]}],"versions":["4.0.0.RELEASE"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.1"}]}],"versions":["4.0.0.RELEASE"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.1"}]}],"versions":["4.0.0.RELEASE"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1.RELEASE"},{"fixed":"3.1.1.RELEASE-tuxcare.1"}]}],"versions":["3.1.1.RELEASE"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1.RELEASE"},{"fixed":"3.1.1.RELEASE-tuxcare.1"}]}],"versions":["3.1.1.RELEASE"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1.RELEASE"},{"fixed":"3.1.1.RELEASE-tuxcare.1"}]}],"versions":["3.1.1.RELEASE"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1.RELEASE"},{"fixed":"3.1.1.RELEASE-tuxcare.1"}]}],"versions":["3.1.1.RELEASE"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-oxm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1.RELEASE"},{"fixed":"3.1.1.RELEASE-tuxcare.1"}]}],"versions":["3.1.1.RELEASE"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1.RELEASE"},{"fixed":"3.1.1.RELEASE-tuxcare.1"}]}],"versions":["3.1.1.RELEASE"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1.RELEASE"},{"fixed":"3.1.1.RELEASE-tuxcare.1"}]}],"versions":["3.1.1.RELEASE"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-framework-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.7"},{"fixed":"5.3.7-tuxcare.2"}]}],"versions":["5.3.7","5.3.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.7"},{"fixed":"5.3.7-tuxcare.2"}]}],"versions":["5.3.7","5.3.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.7"},{"fixed":"5.3.7-tuxcare.2"}]}],"versions":["5.3.7","5.3.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.7"},{"fixed":"5.3.7-tuxcare.2"}]}],"versions":["5.3.7","5.3.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.7"},{"fixed":"5.3.7-tuxcare.2"}]}],"versions":["5.3.7","5.3.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.7"},{"fixed":"5.3.7-tuxcare.2"}]}],"versions":["5.3.7","5.3.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.7"},{"fixed":"5.3.7-tuxcare.2"}]}],"versions":["5.3.7","5.3.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.7"},{"fixed":"5.3.7-tuxcare.2"}]}],"versions":["5.3.7","5.3.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.25"},{"fixed":"5.3.25-tuxcare.1"}]}],"versions":["5.3.25"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.25"},{"fixed":"5.3.25-tuxcare.1"}]}],"versions":["5.3.25"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.25"},{"fixed":"5.3.25-tuxcare.1"}]}],"versions":["5.3.25"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.25"},{"fixed":"5.3.25-tuxcare.1"}]}],"versions":["5.3.25"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.25"},{"fixed":"5.3.25-tuxcare.1"}]}],"versions":["5.3.25"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.25"},{"fixed":"5.3.25-tuxcare.1"}]}],"versions":["5.3.25"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.25"},{"fixed":"5.3.25-tuxcare.1"}]}],"versions":["5.3.25"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.7.RELEASE"},{"fixed":"4.1.7.RELEASE-tuxcare.3"}]}],"versions":["4.1.7.RELEASE","4.1.7.RELEASE-tuxcare.1","4.1.7.RELEASE-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.7.RELEASE"},{"fixed":"4.1.7.RELEASE-tuxcare.3"}]}],"versions":["4.1.7.RELEASE","4.1.7.RELEASE-tuxcare.1","4.1.7.RELEASE-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.7.RELEASE"},{"fixed":"4.1.7.RELEASE-tuxcare.3"}]}],"versions":["4.1.7.RELEASE","4.1.7.RELEASE-tuxcare.1","4.1.7.RELEASE-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.7.RELEASE"},{"fixed":"4.1.7.RELEASE-tuxcare.3"}]}],"versions":["4.1.7.RELEASE","4.1.7.RELEASE-tuxcare.1","4.1.7.RELEASE-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.13.RELEASE"},{"fixed":"5.2.13.RELEASE-tuxcare.4"}]}],"versions":["5.2.13.RELEASE","5.2.13.RELEASE-tuxcare.1","5.2.13.RELEASE-tuxcare.2","5.2.13.RELEASE-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.13.RELEASE"},{"fixed":"5.2.13.RELEASE-tuxcare.4"}]}],"versions":["5.2.13.RELEASE","5.2.13.RELEASE-tuxcare.1","5.2.13.RELEASE-tuxcare.2","5.2.13.RELEASE-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.13.RELEASE"},{"fixed":"5.2.13.RELEASE-tuxcare.4"}]}],"versions":["5.2.13.RELEASE","5.2.13.RELEASE-tuxcare.1","5.2.13.RELEASE-tuxcare.2","5.2.13.RELEASE-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.9.RELEASE"},{"fixed":"4.2.9.RELEASE-tuxcare.1"}]}],"versions":["4.2.9.RELEASE"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.9.RELEASE"},{"fixed":"4.2.9.RELEASE-tuxcare.1"}]}],"versions":["4.2.9.RELEASE"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.9.RELEASE"},{"fixed":"4.2.9.RELEASE-tuxcare.1"}]}],"versions":["4.2.9.RELEASE"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.9.RELEASE"},{"fixed":"4.2.9.RELEASE-tuxcare.1"}]}],"versions":["4.2.9.RELEASE"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.2"}]}],"versions":["5.1.5.RELEASE","5.1.5.RELEASE-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.2"}]}],"versions":["5.1.5.RELEASE","5.1.5.RELEASE-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.2"}]}],"versions":["5.1.5.RELEASE","5.1.5.RELEASE-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.2"}]}],"versions":["5.1.5.RELEASE","5.1.5.RELEASE-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.2"}]}],"versions":["5.1.5.RELEASE","5.1.5.RELEASE-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.2"}]}],"versions":["5.1.5.RELEASE","5.1.5.RELEASE-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.20.RELEASE"},{"fixed":"5.1.20.RELEASE-tuxcare.1"}]}],"versions":["5.1.20.RELEASE"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.20.RELEASE"},{"fixed":"5.1.20.RELEASE-tuxcare.1"}]}],"versions":["5.1.20.RELEASE"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.20.RELEASE"},{"fixed":"5.1.20.RELEASE-tuxcare.1"}]}],"versions":["5.1.20.RELEASE"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.20.RELEASE"},{"fixed":"5.1.20.RELEASE-tuxcare.1"}]}],"versions":["5.1.20.RELEASE"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.20.RELEASE"},{"fixed":"5.1.20.RELEASE-tuxcare.1"}]}],"versions":["5.1.20.RELEASE"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.20.RELEASE"},{"fixed":"5.1.20.RELEASE-tuxcare.1"}]}],"versions":["5.1.20.RELEASE"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.20.RELEASE"},{"fixed":"5.1.20.RELEASE-tuxcare.1"}]}],"versions":["5.1.20.RELEASE"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.20.RELEASE"},{"fixed":"5.1.20.RELEASE-tuxcare.1"}]}],"versions":["5.1.20.RELEASE"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.5.RELEASE"},{"fixed":"3.0.5.RELEASE-tuxcare.7"}]}],"versions":["3.0.5.RELEASE","3.0.5.RELEASE-tuxcare.1","3.0.5.RELEASE-tuxcare.2","3.0.5.RELEASE-tuxcare.3","3.0.5.RELEASE-tuxcare.4","3.0.5.RELEASE-tuxcare.5","3.0.5.RELEASE-tuxcare.6"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.5.RELEASE"},{"fixed":"3.0.5.RELEASE-tuxcare.7"}]}],"versions":["3.0.5.RELEASE","3.0.5.RELEASE-tuxcare.1","3.0.5.RELEASE-tuxcare.2","3.0.5.RELEASE-tuxcare.3","3.0.5.RELEASE-tuxcare.4","3.0.5.RELEASE-tuxcare.5","3.0.5.RELEASE-tuxcare.6"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.24"},{"fixed":"5.3.24-tuxcare.3"}]}],"versions":["5.3.24","5.3.24-tuxcare.1","5.3.24-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.9.RELEASE"},{"fixed":"4.1.9.RELEASE-tuxcare.1"}]}],"versions":["4.1.9.RELEASE"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.9.RELEASE"},{"fixed":"4.1.9.RELEASE-tuxcare.1"}]}],"versions":["4.1.9.RELEASE"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.9.RELEASE"},{"fixed":"4.1.9.RELEASE-tuxcare.1"}]}],"versions":["4.1.9.RELEASE"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.9.RELEASE"},{"fixed":"4.1.9.RELEASE-tuxcare.1"}]}],"versions":["4.1.9.RELEASE"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.9.RELEASE"},{"fixed":"4.1.9.RELEASE-tuxcare.1"}]}],"versions":["4.1.9.RELEASE"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.9.RELEASE"},{"fixed":"4.1.9.RELEASE-tuxcare.1"}]}],"versions":["4.1.9.RELEASE"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.9.RELEASE"},{"fixed":"4.1.9.RELEASE-tuxcare.1"}]}],"versions":["4.1.9.RELEASE"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9.RELEASE"},{"fixed":"5.1.9.RELEASE-tuxcare.2"}]}],"versions":["5.1.9.RELEASE","5.1.9.RELEASE-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9.RELEASE"},{"fixed":"5.1.9.RELEASE-tuxcare.2"}]}],"versions":["5.1.9.RELEASE","5.1.9.RELEASE-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9.RELEASE"},{"fixed":"5.1.9.RELEASE-tuxcare.2"}]}],"versions":["5.1.9.RELEASE","5.1.9.RELEASE-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9.RELEASE"},{"fixed":"5.1.9.RELEASE-tuxcare.2"}]}],"versions":["5.1.9.RELEASE","5.1.9.RELEASE-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-framework-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9.RELEASE"},{"fixed":"5.1.9.RELEASE-tuxcare.2"}]}],"versions":["5.1.9.RELEASE","5.1.9.RELEASE-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9.RELEASE"},{"fixed":"5.1.9.RELEASE-tuxcare.2"}]}],"versions":["5.1.9.RELEASE","5.1.9.RELEASE-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9.RELEASE"},{"fixed":"5.1.9.RELEASE-tuxcare.2"}]}],"versions":["5.1.9.RELEASE","5.1.9.RELEASE-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9.RELEASE"},{"fixed":"5.1.9.RELEASE-tuxcare.2"}]}],"versions":["5.1.9.RELEASE","5.1.9.RELEASE-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9.RELEASE"},{"fixed":"5.1.9.RELEASE-tuxcare.2"}]}],"versions":["5.1.9.RELEASE","5.1.9.RELEASE-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.13.RELEASE"},{"fixed":"5.0.13.RELEASE-tuxcare.1"}]}],"versions":["5.0.13.RELEASE"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.13.RELEASE"},{"fixed":"5.0.13.RELEASE-tuxcare.1"}]}],"versions":["5.0.13.RELEASE"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.13.RELEASE"},{"fixed":"5.0.13.RELEASE-tuxcare.1"}]}],"versions":["5.0.13.RELEASE"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.13.RELEASE"},{"fixed":"5.0.13.RELEASE-tuxcare.1"}]}],"versions":["5.0.13.RELEASE"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.13.RELEASE"},{"fixed":"5.0.13.RELEASE-tuxcare.1"}]}],"versions":["5.0.13.RELEASE"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.13.RELEASE"},{"fixed":"5.0.13.RELEASE-tuxcare.1"}]}],"versions":["5.0.13.RELEASE"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.4.RELEASE"},{"fixed":"4.3.4.RELEASE-tuxcare.2"}]}],"versions":["4.3.4.RELEASE","4.3.4.RELEASE-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.4.RELEASE"},{"fixed":"4.3.4.RELEASE-tuxcare.2"}]}],"versions":["4.3.4.RELEASE","4.3.4.RELEASE-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.4.RELEASE"},{"fixed":"4.3.4.RELEASE-tuxcare.2"}]}],"versions":["4.3.4.RELEASE","4.3.4.RELEASE-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.4.RELEASE"},{"fixed":"4.3.4.RELEASE-tuxcare.2"}]}],"versions":["4.3.4.RELEASE","4.3.4.RELEASE-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.4.RELEASE"},{"fixed":"4.3.4.RELEASE-tuxcare.2"}]}],"versions":["4.3.4.RELEASE","4.3.4.RELEASE-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.25.RELEASE"},{"fixed":"4.3.25.RELEASE-tuxcare.1"}]}],"versions":["4.3.25.RELEASE"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.25.RELEASE"},{"fixed":"4.3.25.RELEASE-tuxcare.1"}]}],"versions":["4.3.25.RELEASE"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.25.RELEASE"},{"fixed":"4.3.25.RELEASE-tuxcare.1"}]}],"versions":["4.3.25.RELEASE"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.9.RELEASE"},{"fixed":"4.3.9.RELEASE-tuxcare.2"}]}],"versions":["4.3.9.RELEASE","4.3.9.RELEASE-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.9.RELEASE"},{"fixed":"4.3.9.RELEASE-tuxcare.2"}]}],"versions":["4.3.9.RELEASE","4.3.9.RELEASE-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.9.RELEASE"},{"fixed":"4.3.9.RELEASE-tuxcare.2"}]}],"versions":["4.3.9.RELEASE","4.3.9.RELEASE-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.9.RELEASE"},{"fixed":"4.3.9.RELEASE-tuxcare.2"}]}],"versions":["4.3.9.RELEASE","4.3.9.RELEASE-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.9.RELEASE"},{"fixed":"4.3.9.RELEASE-tuxcare.2"}]}],"versions":["4.3.9.RELEASE","4.3.9.RELEASE-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.5.RELEASE"},{"fixed":"5.0.5.RELEASE-tuxcare.2"}]}],"versions":["5.0.5.RELEASE","5.0.5.RELEASE-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.5.RELEASE"},{"fixed":"5.0.5.RELEASE-tuxcare.2"}]}],"versions":["5.0.5.RELEASE","5.0.5.RELEASE-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.5.RELEASE"},{"fixed":"5.0.5.RELEASE-tuxcare.2"}]}],"versions":["5.0.5.RELEASE","5.0.5.RELEASE-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.5.RELEASE"},{"fixed":"5.0.5.RELEASE-tuxcare.2"}]}],"versions":["5.0.5.RELEASE","5.0.5.RELEASE-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.5.RELEASE"},{"fixed":"5.0.5.RELEASE-tuxcare.2"}]}],"versions":["5.0.5.RELEASE","5.0.5.RELEASE-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.5.RELEASE"},{"fixed":"5.0.5.RELEASE-tuxcare.2"}]}],"versions":["5.0.5.RELEASE","5.0.5.RELEASE-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.5.RELEASE"},{"fixed":"5.0.5.RELEASE-tuxcare.2"}]}],"versions":["5.0.5.RELEASE","5.0.5.RELEASE-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.2"}]}],"versions":["5.1.6.RELEASE","5.1.6.RELEASE-tuxcare.1"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.2"}]}],"versions":["5.1.6.RELEASE","5.1.6.RELEASE-tuxcare.1"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.2"}]}],"versions":["5.1.6.RELEASE","5.1.6.RELEASE-tuxcare.1"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.2"}]}],"versions":["5.1.6.RELEASE","5.1.6.RELEASE-tuxcare.1"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-framework-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.2"}]}],"versions":["5.1.6.RELEASE","5.1.6.RELEASE-tuxcare.1"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.2"}]}],"versions":["5.1.6.RELEASE","5.1.6.RELEASE-tuxcare.1"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.2"}]}],"versions":["5.1.6.RELEASE","5.1.6.RELEASE-tuxcare.1"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.2"}]}],"versions":["5.1.6.RELEASE","5.1.6.RELEASE-tuxcare.1"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.2"}]}],"versions":["5.1.6.RELEASE","5.1.6.RELEASE-tuxcare.1"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.21"},{"fixed":"5.3.21-tuxcare.1"}]}],"versions":["5.3.21"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.21"},{"fixed":"5.3.21-tuxcare.1"}]}],"versions":["5.3.21"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.21"},{"fixed":"5.3.21-tuxcare.1"}]}],"versions":["5.3.21"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.21"},{"fixed":"5.3.21-tuxcare.1"}]}],"versions":["5.3.21"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.21"},{"fixed":"5.3.21-tuxcare.1"}]}],"versions":["5.3.21"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.21"},{"fixed":"5.3.21-tuxcare.1"}]}],"versions":["5.3.21"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.21"},{"fixed":"5.3.21-tuxcare.1"}]}],"versions":["5.3.21"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.21"},{"fixed":"5.3.21-tuxcare.1"}]}],"versions":["5.3.21"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.21"},{"fixed":"5.3.21-tuxcare.1"}]}],"versions":["5.3.21"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.21"},{"fixed":"5.3.21-tuxcare.1"}]}],"versions":["5.3.21"],"bundled":29},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.0-tuxcare.1"}]}],"versions":["6.0.0"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.0-tuxcare.1"}]}],"versions":["6.0.0"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.0-tuxcare.1"}]}],"versions":["6.0.0"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.0-tuxcare.1"}]}],"versions":["6.0.0"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.0-tuxcare.1"}]}],"versions":["6.0.0"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.1"}]}],"versions":["5.3.6"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.1"}]}],"versions":["5.3.6"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.1"}]}],"versions":["5.3.6"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.1"}]}],"versions":["5.3.6"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.1"}]}],"versions":["5.3.6"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.1"}]}],"versions":["5.3.6"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.1"}]}],"versions":["5.3.6"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.1"}]}],"versions":["5.3.6"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.1"}]}],"versions":["5.3.6"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.23"},{"fixed":"5.3.23-tuxcare.1"}]}],"versions":["5.3.23"],"bundled":35},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.23"},{"fixed":"5.3.23-tuxcare.1"}]}],"versions":["5.3.23"],"bundled":35},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.23"},{"fixed":"5.3.23-tuxcare.1"}]}],"versions":["5.3.23"],"bundled":35},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.23"},{"fixed":"5.3.23-tuxcare.1"}]}],"versions":["5.3.23"],"bundled":35},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.23"},{"fixed":"5.3.23-tuxcare.1"}]}],"versions":["5.3.23"],"bundled":35},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.23"},{"fixed":"5.3.23-tuxcare.1"}]}],"versions":["5.3.23"],"bundled":35},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.23"},{"fixed":"5.3.23-tuxcare.1"}]}],"versions":["5.3.23"],"bundled":35},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.23"},{"fixed":"5.3.23-tuxcare.1"}]}],"versions":["5.3.23"],"bundled":35},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.23"},{"fixed":"5.3.23-tuxcare.1"}]}],"versions":["5.3.23"],"bundled":35},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.23"},{"fixed":"5.3.23-tuxcare.1"}]}],"versions":["5.3.23"],"bundled":35},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.13"},{"fixed":"5.3.13-tuxcare.1"}]}],"versions":["5.3.13"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.13"},{"fixed":"5.3.13-tuxcare.1"}]}],"versions":["5.3.13"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.13"},{"fixed":"5.3.13-tuxcare.1"}]}],"versions":["5.3.13"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.13"},{"fixed":"5.3.13-tuxcare.1"}]}],"versions":["5.3.13"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.13"},{"fixed":"5.3.13-tuxcare.1"}]}],"versions":["5.3.13"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.13"},{"fixed":"5.3.13-tuxcare.1"}]}],"versions":["5.3.13"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.13"},{"fixed":"5.3.13-tuxcare.1"}]}],"versions":["5.3.13"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.13"},{"fixed":"5.3.13-tuxcare.1"}]}],"versions":["5.3.13"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.13"},{"fixed":"5.3.13-tuxcare.1"}]}],"versions":["5.3.13"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.13"},{"fixed":"5.3.13-tuxcare.1"}]}],"versions":["5.3.13"],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.1"}]}],"versions":["5.3.5"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.1"}]}],"versions":["5.3.5"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.1"}]}],"versions":["5.3.5"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.1"}]}],"versions":["5.3.5"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.1"}]}],"versions":["5.3.5"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.1"}]}],"versions":["5.3.5"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.1"}]}],"versions":["5.3.5"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.1"}]}],"versions":["5.3.5"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.3"},{"fixed":"5.3.3-tuxcare.1"}]}],"versions":["5.3.3"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.3"},{"fixed":"5.3.3-tuxcare.1"}]}],"versions":["5.3.3"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.3"},{"fixed":"5.3.3-tuxcare.1"}]}],"versions":["5.3.3"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.3"},{"fixed":"5.3.3-tuxcare.1"}]}],"versions":["5.3.3"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.3"},{"fixed":"5.3.3-tuxcare.1"}]}],"versions":["5.3.3"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.3"},{"fixed":"5.3.3-tuxcare.1"}]}],"versions":["5.3.3"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.3"},{"fixed":"5.3.3-tuxcare.1"}]}],"versions":["5.3.3"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.3"},{"fixed":"5.3.3-tuxcare.1"}]}],"versions":["5.3.3"],"bundled":25},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.21.RELEASE"},{"fixed":"4.3.21.RELEASE-tuxcare.1"}]}],"versions":["4.3.21.RELEASE"],"bundled":28},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.21.RELEASE"},{"fixed":"4.3.21.RELEASE-tuxcare.1"}]}],"versions":["4.3.21.RELEASE"],"bundled":28},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.21.RELEASE"},{"fixed":"4.3.21.RELEASE-tuxcare.1"}]}],"versions":["4.3.21.RELEASE"],"bundled":28},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.21.RELEASE"},{"fixed":"4.3.21.RELEASE-tuxcare.1"}]}],"versions":["4.3.21.RELEASE"],"bundled":28},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.21.RELEASE"},{"fixed":"4.3.21.RELEASE-tuxcare.1"}]}],"versions":["4.3.21.RELEASE"],"bundled":28},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.21.RELEASE"},{"fixed":"4.3.21.RELEASE-tuxcare.1"}]}],"versions":["4.3.21.RELEASE"],"bundled":28},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.21.RELEASE"},{"fixed":"4.3.21.RELEASE-tuxcare.1"}]}],"versions":["4.3.21.RELEASE"],"bundled":28},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.21.RELEASE"},{"fixed":"4.3.21.RELEASE-tuxcare.1"}]}],"versions":["4.3.21.RELEASE"],"bundled":28},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.21.RELEASE"},{"fixed":"4.3.21.RELEASE-tuxcare.1"}]}],"versions":["4.3.21.RELEASE"],"bundled":28},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.16.RELEASE"},{"fixed":"4.3.16.RELEASE-tuxcare.1"}]}],"versions":["4.3.16.RELEASE"],"bundled":31},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.16.RELEASE"},{"fixed":"4.3.16.RELEASE-tuxcare.1"}]}],"versions":["4.3.16.RELEASE"],"bundled":31},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.16.RELEASE"},{"fixed":"4.3.16.RELEASE-tuxcare.1"}]}],"versions":["4.3.16.RELEASE"],"bundled":31},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.16.RELEASE"},{"fixed":"4.3.16.RELEASE-tuxcare.1"}]}],"versions":["4.3.16.RELEASE"],"bundled":31},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.16.RELEASE"},{"fixed":"4.3.16.RELEASE-tuxcare.1"}]}],"versions":["4.3.16.RELEASE"],"bundled":31},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.16.RELEASE"},{"fixed":"4.3.16.RELEASE-tuxcare.1"}]}],"versions":["4.3.16.RELEASE"],"bundled":31},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.16.RELEASE"},{"fixed":"4.3.16.RELEASE-tuxcare.1"}]}],"versions":["4.3.16.RELEASE"],"bundled":31},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.16.RELEASE"},{"fixed":"4.3.16.RELEASE-tuxcare.1"}]}],"versions":["4.3.16.RELEASE"],"bundled":31},{"source":"osv","ecosystem":"Debian:12","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-2","4.3.30-3","4.3.30-4","4.3.30-5","4.3.30-6"]},{"source":"osv","ecosystem":"Debian:13","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3","4.3.30-4","4.3.30-5","4.3.30-6"]},{"source":"osv","ecosystem":"Debian:14","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3","4.3.30-4","4.3.30-5","4.3.30-6"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.8"}]}],"versions":["6.0.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0.5","6.0.6","6.0.7"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"fixed":"5.3.27"}]}],"versions":["5.3.0","5.3.1","5.3.10","5.3.11","5.3.12","5.3.13","5.3.14","5.3.15","5.3.16","5.3.17","5.3.18","5.3.19","5.3.2","5.3.20","5.3.21","5.3.22","5.3.23","5.3.24","5.3.25","5.3.26","5.3.3","5.3.4","5.3.5","5.3.6","5.3.7","5.3.8","5.3.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.24.RELEASE"}]}],"versions":["3.0.0.RELEASE","3.0.1.RELEASE","3.0.2.RELEASE","3.0.3.RELEASE","3.0.4.RELEASE","3.0.5.RELEASE","3.0.6.RELEASE","3.0.7.RELEASE","3.1.0.RELEASE","3.1.1.RELEASE","3.1.2.RELEASE","3.1.3.RELEASE","3.1.4.RELEASE","3.2.0.RELEASE","3.2.1.RELEASE","3.2.10.RELEASE","3.2.11.RELEASE","3.2.12.RELEASE","3.2.13.RELEASE","3.2.14.RELEASE","3.2.15.RELEASE","3.2.16.RELEASE","3.2.17.RELEASE","3.2.18.RELEASE","3.2.2.RELEASE","3.2.3.RELEASE","3.2.4.RELEASE","3.2.5.RELEASE","3.2.6.RELEASE","3.2.7.RELEASE","3.2.8.RELEASE","3.2.9.RELEASE","4.0.0.RELEASE","4.0.1.RELEASE","4.0.2.RELEASE","4.0.3.RELEASE","4.0.4.RELEASE","4.0.5.RELEASE","4.0.6.RELEASE","4.0.7.RELEASE","4.0.8.RELEASE","4.0.9.RELEASE","4.1.0.RELEASE","4.1.1.RELEASE","4.1.2.RELEASE","4.1.3.RELEASE","4.1.4.RELEASE","4.1.5.RELEASE","4.1.6.RELEASE","4.1.7.RELEASE","4.1.8.RELEASE","4.1.9.RELEASE","4.2.0.RELEASE","4.2.1.RELEASE","4.2.2.RELEASE","4.2.3.RELEASE","4.2.4.RELEASE","4.2.5.RELEASE","4.2.6.RELEASE","4.2.7.RELEASE","4.2.8.RELEASE","4.2.9.RELEASE","4.3.0.RELEASE","4.3.1.RELEASE","4.3.10.RELEASE","4.3.11.RELEASE","4.3.12.RELEASE","4.3.13.RELEASE","4.3.14.RELEASE","4.3.15.RELEASE","4.3.16.RELEASE","4.3.17.RELEASE","4.3.18.RELEASE","4.3.19.RELEASE","4.3.2.RELEASE","4.3.20.RELEASE","4.3.21.RELEASE","4.3.22.RELEASE","4.3.23.RELEASE","4.3.24.RELEASE","4.3.25.RELEASE","4.3.26.RELEASE","4.3.27.RELEASE","4.3.28.RELEASE","4.3.29.RELEASE","4.3.3.RELEASE","4.3.30.RELEASE","4.3.4.RELEASE","4.3.5.RELEASE","4.3.6.RELEASE","4.3.7.RELEASE","4.3.8.RELEASE","4.3.9.RELEASE","5.0.0.RELEASE","5.0.1.RELEASE","5.0.10.RELEASE","5.0.11.RELEASE","5.0.12.RELEASE","5.0.13.RELEASE","5.0.14.RELEASE","5.0.15.RELEASE","5.0.16.RELEASE","5.0.17.RELEASE","5.0.18.RELEASE","5.0.19.RELEASE","5.0.2.RELEASE","5.0.20.RELEASE","5.0.3.RELEASE","5.0.4.RELEASE","5.0.5.RELEASE","5.0.6.RELEASE","5.0.7.RELEASE","5.0.8.RELEASE","5.0.9.RELEASE","5.1.0.RELEASE","5.1.1.RELEASE","5.1.10.RELEASE","5.1.11.RELEASE","5.1.12.RELEASE","5.1.13.RELEASE","5.1.14.RELEASE","5.1.15.RELEASE","5.1.16.RELEASE","5.1.17.RELEASE","5.1.18.RELEASE","5.1.19.RELEASE","5.1.2.RELEASE","5.1.20.RELEASE","5.1.3.RELEASE","5.1.4.RELEASE","5.1.5.RELEASE","5.1.6.RELEASE","5.1.7.RELEASE","5.1.8.RELEASE","5.1.9.RELEASE","5.2.0.RELEASE","5.2.1.RELEASE","5.2.10.RELEASE","5.2.11.RELEASE","5.2.12.RELEASE","5.2.13.RELEASE","5.2.14.RELEASE","5.2.15.RELEASE","5.2.16.RELEASE","5.2.17.RELEASE","5.2.18.RELEASE","5.2.19.RELEASE","5.2.2.RELEASE","5.2.20.RELEASE","5.2.21.RELEASE","5.2.22.RELEASE","5.2.23.RELEASE","5.2.3.RELEASE","5.2.4.RELEASE","5.2.5.RELEASE","5.2.6.RELEASE","5.2.7.RELEASE","5.2.8.RELEASE","5.2.9.RELEASE"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.18.rhlw-00010"}]}],"versions":["3.0.0.RELEASE","3.0.1.RELEASE","3.0.2.RELEASE","3.0.3.RELEASE","3.0.4.RELEASE","3.0.5.RELEASE","3.0.6.RELEASE","3.0.7.RELEASE","3.1.0.RELEASE","3.1.1.RELEASE","3.1.2.RELEASE","3.1.3.RELEASE","3.1.4.RELEASE","3.2.0.RELEASE","3.2.1.RELEASE","3.2.10.RELEASE","3.2.11.RELEASE","3.2.12.RELEASE","3.2.13.RELEASE","3.2.14.RELEASE","3.2.15.RELEASE","3.2.16.RELEASE","3.2.17.RELEASE","3.2.18.RELEASE","3.2.2.RELEASE","3.2.3.RELEASE","3.2.4.RELEASE","3.2.5.RELEASE","3.2.6.RELEASE","3.2.7.RELEASE","3.2.8.RELEASE","3.2.9.RELEASE","4.0.0.RELEASE","4.0.1.RELEASE","4.0.2.RELEASE","4.0.3.RELEASE","4.0.4.RELEASE","4.0.5.RELEASE","4.0.6.RELEASE","4.0.7.RELEASE","4.0.8.RELEASE","4.0.9.RELEASE","4.1.0.RELEASE","4.1.1.RELEASE","4.1.2.RELEASE","4.1.3.RELEASE","4.1.4.RELEASE","4.1.5.RELEASE","4.1.6.RELEASE","4.1.7.RELEASE","4.1.8.RELEASE","4.1.9.RELEASE","4.2.0.RELEASE","4.2.1.RELEASE","4.2.2.RELEASE","4.2.3.RELEASE","4.2.4.RELEASE","4.2.5.RELEASE","4.2.6.RELEASE","4.2.7.RELEASE","4.2.8.RELEASE","4.2.9.RELEASE","4.3.0.RELEASE","4.3.1.RELEASE","4.3.10.RELEASE","4.3.11.RELEASE","4.3.12.RELEASE","4.3.13.RELEASE","4.3.14.RELEASE","4.3.15.RELEASE","4.3.16.RELEASE","4.3.17.RELEASE","4.3.18.RELEASE","4.3.19.RELEASE","4.3.2.RELEASE","4.3.20.RELEASE","4.3.21.RELEASE","4.3.22.RELEASE","4.3.23.RELEASE","4.3.24.RELEASE","4.3.25.RELEASE","4.3.26.RELEASE","4.3.27.RELEASE","4.3.28.RELEASE","4.3.29.RELEASE","4.3.3.RELEASE","4.3.30.RELEASE","4.3.4.RELEASE","4.3.5.RELEASE","4.3.6.RELEASE","4.3.7.RELEASE","4.3.8.RELEASE","4.3.9.RELEASE","5.0.0.RELEASE","5.0.1.RELEASE","5.0.10.RELEASE","5.0.11.RELEASE","5.0.12.RELEASE","5.0.13.RELEASE","5.0.14.RELEASE","5.0.15.RELEASE","5.0.16.RELEASE","5.0.17.RELEASE","5.0.18.RELEASE","5.0.19.RELEASE","5.0.2.RELEASE","5.0.20.RELEASE","5.0.3.RELEASE","5.0.4.RELEASE","5.0.5.RELEASE","5.0.6.RELEASE","5.0.7.RELEASE","5.0.8.RELEASE","5.0.9.RELEASE","5.1.0.RELEASE","5.1.1.RELEASE","5.1.10.RELEASE","5.1.11.RELEASE","5.1.12.RELEASE","5.1.13.RELEASE","5.1.14.RELEASE","5.1.15.RELEASE","5.1.16.RELEASE","5.1.17.RELEASE","5.1.18.RELEASE","5.1.19.RELEASE","5.1.2.RELEASE","5.1.20.RELEASE","5.1.3.RELEASE","5.1.4.RELEASE","5.1.5.RELEASE","5.1.6.RELEASE","5.1.7.RELEASE","5.1.8.RELEASE","5.1.9.RELEASE","5.2.0.RELEASE","5.2.1.RELEASE","5.2.10.RELEASE","5.2.11.RELEASE","5.2.12.RELEASE","5.2.13.RELEASE","5.2.14.RELEASE","5.2.15.RELEASE","5.2.16.RELEASE","5.2.17.RELEASE","5.2.18.RELEASE","5.2.19.RELEASE","5.2.2.RELEASE","5.2.20.RELEASE","5.2.21.RELEASE","5.2.22.RELEASE","5.2.23.RELEASE","5.2.24.RELEASE","5.2.25.RELEASE","5.2.3.RELEASE","5.2.4.RELEASE","5.2.5.RELEASE","5.2.6.RELEASE","5.2.7.RELEASE","5.2.8.RELEASE","5.2.9.RELEASE","5.3.0","5.3.1","5.3.10","5.3.11","5.3.12","5.3.13","5.3.14","5.3.15","5.3.16","5.3.17","5.3.18","5.3.2","5.3.3","5.3.4","5.3.5","5.3.6","5.3.7","5.3.8","5.3.9"],"bundled":7},{"source":"osv","ecosystem":"Root:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.14-aikido.4"},{"fixed":"5.3.14-aikido.1"},{"fixed":"5.3.14-aikido.2"},{"fixed":"5.3.20-aikido.4"},{"fixed":"5.3.14-aikido.3"},{"fixed":"5.3.20-aikido.5"},{"fixed":"5.3.20-aikido.6"},{"fixed":"5.3.14-aikido.5"},{"fixed":"4.0.3.RELEASE-aikido.1"},{"fixed":"4.0.3.RELEASE-aikido.2"},{"fixed":"5.3.14-aikido.6"},{"fixed":"4.0.3.RELEASE-aikido.3"},{"fixed":"4.0.3.RELEASE-aikido.4"},{"fixed":"5.3.20-aikido.7"},{"fixed":"5.3.14-aikido.7"},{"fixed":"4.0.3.RELEASE-aikido.5"},{"fixed":"4.0.3.RELEASE-aikido.6"},{"fixed":"5.3.20-aikido.8"},{"fixed":"5.3.14-aikido.8"},{"fixed":"4.0.3.RELEASE-aikido.7"},{"fixed":"4.0.3.RELEASE-aikido.8"},{"fixed":"5.3.27-aikido.2"},{"fixed":"5.3.27-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.14-root.io.4"},{"fixed":"5.3.14-root.io.1"},{"fixed":"5.3.14-root.io.2"},{"fixed":"5.3.20-root.io.4"},{"fixed":"5.3.14-root.io.3"},{"fixed":"5.3.20-root.io.5"},{"fixed":"5.3.20-root.io.6"},{"fixed":"5.3.14-root.io.5"},{"fixed":"4.0.3.RELEASE-root.io.1"},{"fixed":"4.0.3.RELEASE-root.io.2"},{"fixed":"5.3.14-root.io.6"},{"fixed":"4.0.3.RELEASE-root.io.3"},{"fixed":"4.0.3.RELEASE-root.io.4"},{"fixed":"5.3.20-root.io.7"},{"fixed":"5.3.14-root.io.7"},{"fixed":"4.0.3.RELEASE-root.io.5"},{"fixed":"4.0.3.RELEASE-root.io.6"},{"fixed":"5.3.20-root.io.8"},{"fixed":"5.3.14-root.io.8"},{"fixed":"4.0.3.RELEASE-root.io.7"},{"fixed":"4.0.3.RELEASE-root.io.8"},{"fixed":"5.3.27-root.io.2"},{"fixed":"5.3.27-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.6.RELEASE-7","3.0.6.RELEASE-8","3.0.6.RELEASE-9","3.0.6.RELEASE-10","3.0.6.RELEASE-11","3.0.6.RELEASE-12","3.0.6.RELEASE-13","3.0.6.RELEASE-13ubuntu0.1~esm1","3.0.6.RELEASE-13ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.13-3","3.2.13-4","3.2.13-5","3.2.13-5ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.11-1","4.3.12-1","4.3.13-2","4.3.14-1","4.3.22-1~18.04","4.3.22-1~18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.22-4","4.3.22-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-1","4.3.30-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-2","4.3.30-2ubuntu0.24.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-2ubuntu1","4.3.30-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3ubuntu1"]}],"affected_more":108,"products":[{"vendor":"vmware","product":"spring framework"},{"vendor":"vmware","product":"spring_framework"}],"references":[{"url":"https://spring.io/security/cve-2023-20863","tags":["x_transferred","Vendor Advisory","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20240524-0015/","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-20863","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-framework/commit/b73f5fcac22555f844cf27a7eeb876cb9d7f7f7e","tags":["web"]},{"url":"https://github.com/spring-projects/spring-framework/commit/965a6392757d20f9db19241126fcc719a51eac15","tags":["web"]},{"url":"https://github.com/spring-projects/spring-framework/commit/ebc82654282bda547fbc20a9749ab1bda886a46f","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20240524-0015","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wxqc-pxw9-g2p8","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/20xxx/CVE-2023-20863.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-20863","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-framework","tags":["package"]},{"url":"https://spring.io/security/cve-2023-20860","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/20xxx/CVE-2023-20860.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-20860","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7phw-cxx7-q9vq","tags":["advisory"]},{"url":"https://spring.io/security/cve-2025-41249","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-41249","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jmp9-x22r-554x","tags":["advisory"]},{"url":"https://spring.io/security/cve-2024-38816","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38816","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cx7f-g6mp-7hqm","tags":["advisory"]},{"url":"https://spring.io/security/cve-2024-22243","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22243","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-ccgv-vj62-xf9h","tags":["advisory"]},{"url":"https://spring.io/security/cve-2024-38808","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38808.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38808","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9cmq-m9j5-mvww","tags":["advisory"]},{"url":"https://spring.io/security/cve-2023-20861","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/20xxx/CVE-2023-20861.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-20861","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-564r-hj7v-mcr5","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-20863","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-20863","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-20863","description":"In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.","status":"published","published":"2023-04-13T00:00:00Z","modified":"2025-02-07T16:48:13.438Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-400","CWE-400"],"updated_at":"2026-11-02T14:35:13.368958Z"}],"euvd":[{"id":"EUVD-2023-1417","description":"In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.","status":"published","published":"2023-04-13T00:00:00Z","modified":"2025-02-07T16:48:13Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:04:02.347135Z"}],"ghsa":[{"id":"GHSA-wxqc-pxw9-g2p8","title":"Spring Framework vulnerable to denial of service","description":"In Spring Framework versions prior to 5.2.24.release+ , 5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial-of-service (DoS) condition.","status":"published","published":"2023-04-13T21:30:27Z","modified":"2024-06-10T18:31:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770","CWE-917"],"updated_at":"2026-11-02T14:37:54.624184Z"}],"nvd":[{"id":"CVE-2023-20863","description":"In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.","status":"published","published":"2023-04-13T20:15:07.777Z","modified":"2026-06-17T05:31:02.697Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-400","CWE-917"],"updated_at":"2026-11-02T14:07:55.652109Z"}],"osv":[{"id":"CVE-2023-20863","description":"In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.","status":"published","published":"2023-04-13T00:00:00Z","modified":"2026-10-28T02:30:48.278634459Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:30.334753Z"},{"id":"DEBIAN-CVE-2023-20863","description":"In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.","status":"published","published":"2023-04-13T20:15:07.777Z","modified":"2026-10-26T18:00:30.001882578Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"GHSA-wxqc-pxw9-g2p8","title":"Spring Framework vulnerable to denial of service","description":"In Spring Framework versions prior to 5.2.24.release+ , 5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial-of-service (DoS) condition.","status":"published","published":"2023-04-13T21:30:27Z","modified":"2024-06-10T19:04:24.157978Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770","CWE-917"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"RHLW-2026-25544e781d50b856","title":"Lightwell Security Advisory: spring-expression 5.3.18.rhlw-00010","description":"Red Hat Lightwell has released org.springframework:spring-expression 5.3.18.rhlw-00010 with backported fixes for CVE-2023-20860, CVE-2025-41249, CVE-2024-38816, CVE-2024-22243, CVE-2024-38808, CVE-2023-20863, and CVE-2023-20861.\n\nCVE-2023-20860: Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using \"**\" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.\n\nCVE-2025-41249: The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions.\n\nYour application may be affected by this if you are using Spring Security's @EnableMethodSecurity feature.\n\nYou are not affected by this if you are not using @EnableMethodSecurity or if you do not use security annotations on methods in generic superclasses or generic interfaces.\n\nThis CVE is published in conjunction with  CVE-2025-41248 https://spring.io/security/cve-2025-41248 .\n\nCVE-2024-38816: Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.\n\nSpecifically, an application is vulnerable when both of the following are true:\n\n  *  the web application uses RouterFunctions to serve static resources\n  *  resource handling is explicitly configured with a FileSystemResource location\n\n\nHowever, malicious requests are blocked and rejected when any of the following is true:\n\n  *  the  Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html  is in use\n  *  the application runs on Tomcat or Jetty\n\nCVE-2024-22243: Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a  open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.\n\nCVE-2024-38808: CVE-2024-38808: Spring Expression DoS Vulnerability\n\nCVE-2023-20863: In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.\n\nCVE-2023-20861: In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.\n\nThis patched artifact is a drop-in replacement for org.springframework:spring-expression 5.3.18 from Maven Central.","status":"published","published":"2026-07-14T12:50:26Z","modified":"2026-10-27T04:13:00.933467173Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"ROOT-APP-MAVEN-CVE-2023-20863","title":"CVE-2023-20863 in org.springframework:spring-expression - Patched by Root","description":"Root has patched CVE-2023-20863 in the org.springframework:spring-expression package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-11-04T08:25:08Z","modified":"2026-11-04T09:15:03.079180853Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-04T09:34:03.871859Z"},{"id":"UBUNTU-CVE-2023-20863","description":"In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.","status":"published","published":"2023-04-13T20:15:00Z","modified":"2026-10-17T12:57:16.652500022Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:18.756095Z"},{"id":"CLSA-2025-1756771563","title":"TuxCare security update for org.springframework (16 CVEs)","description":"TuxCare rebuilt 6 org.springframework packages to address 16 CVEs. Fixed in 4.3.30.RELEASE-tuxcare.1.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-11-02T19:45:07.298419109Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2025-1760313981","title":"TuxCare security update for org.springframework (25 CVEs)","description":"TuxCare rebuilt 6 org.springframework packages to address 25 CVEs. Fixed in 4.0.0.RELEASE-tuxcare.1.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-11-02T19:45:10.002032675Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2025-1760313986","title":"TuxCare security update for org.springframework (29 CVEs)","description":"TuxCare rebuilt 7 org.springframework packages to address 29 CVEs. Fixed in 3.1.1.RELEASE-tuxcare.1.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-11-02T19:45:07.855395278Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2025-1762906008","title":"TuxCare security update for org.springframework (13 CVEs)","description":"TuxCare rebuilt 10 org.springframework packages to address 13 CVEs. Fixed in 5.2.0.RELEASE-tuxcare.1.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-11-02T19:45:06.085973092Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1776040412","title":"TuxCare security update for org.springframework (13 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 13 CVEs. Fixed in 5.3.7-tuxcare.2.","status":"published","published":"2026-08-04T14:52:24Z","modified":"2026-11-02T19:45:23.931874136Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1777250292","title":"TuxCare security update for org.springframework (5 CVEs)","description":"TuxCare rebuilt 7 org.springframework packages to address 5 CVEs. Fixed in 5.3.25-tuxcare.1.","status":"published","published":"2026-08-04T14:52:28Z","modified":"2026-11-02T19:45:28.37739212Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1777250295","title":"TuxCare security update for org.springframework (5 CVEs)","description":"TuxCare rebuilt 4 org.springframework packages to address 5 CVEs. Fixed in 4.1.7.RELEASE-tuxcare.3.","status":"published","published":"2026-08-04T14:52:28Z","modified":"2026-11-02T19:45:28.348885071Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1777336766","title":"TuxCare security update for org.springframework (4 CVEs)","description":"TuxCare rebuilt 3 org.springframework packages to address 4 CVEs. Fixed in 5.2.13.RELEASE-tuxcare.4.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-11-02T19:45:28.410408612Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1777509606","title":"TuxCare security update for org.springframework (8 CVEs)","description":"TuxCare rebuilt 4 org.springframework packages to address 8 CVEs. Fixed in 4.2.9.RELEASE-tuxcare.1.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-11-02T19:45:28.07523245Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1777855419","title":"TuxCare security update for org.springframework (6 CVEs)","description":"TuxCare rebuilt 6 org.springframework packages to address 6 CVEs. Fixed in 5.1.5.RELEASE-tuxcare.2.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-11-11T01:43:17.808262381Z","updated_at":"2026-11-11T01:47:54.277886Z"},{"id":"CLSA-2026-1777941826","title":"TuxCare security update for org.springframework (10 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 10 CVEs. Fixed in 5.1.20.RELEASE-tuxcare.1.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-11-02T19:45:25.95820547Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1781744126","title":"TuxCare security update for org.springframework (2 CVEs)","description":"TuxCare rebuilt 2 org.springframework packages to address 2 CVEs. Fixed in 3.0.5.RELEASE-tuxcare.7.","status":"published","published":"2026-08-04T14:52:38Z","modified":"2026-11-02T19:45:35.622164222Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1781744127","title":"TuxCare security update for org.springframework:spring-expression (1 CVE)","description":"TuxCare rebuilt org.springframework:spring-expression to address 1 CVE. Fixed in 5.3.24-tuxcare.3.","status":"published","published":"2026-08-04T14:52:38Z","modified":"2026-11-02T19:45:34.871416132Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1782867606","title":"TuxCare security update for org.springframework (12 CVEs)","description":"TuxCare rebuilt 7 org.springframework packages to address 12 CVEs. Fixed in 4.1.9.RELEASE-tuxcare.1.","status":"published","published":"2026-08-04T14:52:40Z","modified":"2026-11-02T19:45:39.141905603Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1785030424","title":"TuxCare security update for org.springframework (14 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 14 CVEs. Fixed in 5.1.9.RELEASE-tuxcare.2.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-11-02T19:45:44.848387376Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1785204448","title":"TuxCare security update for org.springframework (5 CVEs)","description":"TuxCare rebuilt 6 org.springframework packages to address 5 CVEs. Fixed in 5.0.13.RELEASE-tuxcare.1.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-11-02T19:45:47.168301409Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1785380133","title":"TuxCare security update for org.springframework (5 CVEs)","description":"TuxCare rebuilt 5 org.springframework packages to address 5 CVEs. Fixed in 4.3.4.RELEASE-tuxcare.2.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-11-02T19:45:47.859091627Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1785380233","title":"TuxCare security update for org.springframework (2 CVEs)","description":"TuxCare rebuilt 3 org.springframework packages to address 2 CVEs. Fixed in 4.3.25.RELEASE-tuxcare.1.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-11-02T19:45:47.861873457Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1785380498","title":"TuxCare security update for org.springframework (6 CVEs)","description":"TuxCare rebuilt 5 org.springframework packages to address 6 CVEs. Fixed in 4.3.9.RELEASE-tuxcare.2.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-11-02T19:45:48.296732908Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1785814744","title":"TuxCare security update for org.springframework (9 CVEs)","description":"TuxCare rebuilt 7 org.springframework packages to address 9 CVEs. Fixed in 5.0.5.RELEASE-tuxcare.2.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-11-02T19:45:48.950547253Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1785815205","title":"TuxCare security update for org.springframework (23 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 23 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.2.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-11-02T19:45:49.917621697Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1786609560","title":"TuxCare security update for org.grails (18 CVEs)","description":"TuxCare rebuilt 33 org.grails packages to address 18 CVEs. Fixed in 5.3.6-tuxcare.1.","status":"withdrawn","published":"2026-08-13T08:26:00Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1788360559","title":"TuxCare security update for org.springframework (29 CVEs)","description":"TuxCare rebuilt 10 org.springframework packages to address 29 CVEs. Fixed in 5.3.21-tuxcare.1.","status":"published","published":"2026-09-02T14:49:19Z","modified":"2026-11-02T19:46:04.773724636Z","updated_at":"2026-11-02T20:29:46.576514Z"},{"id":"CLSA-2026-1788361406","title":"TuxCare security update for org.springframework (21 CVEs)","description":"TuxCare rebuilt 5 org.springframework packages to address 21 CVEs. Fixed in 6.0.0-tuxcare.1.","status":"published","published":"2026-09-02T15:03:26Z","modified":"2026-11-02T19:46:05.755920698Z","updated_at":"2026-11-02T20:29:46.576514Z"},{"id":"CLSA-2026-1789427454","title":"TuxCare security update for org.springframework (18 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 18 CVEs. Fixed in 5.3.6-tuxcare.1.","status":"published","published":"2026-09-14T23:10:54Z","modified":"2026-11-02T19:46:16.037836811Z","updated_at":"2026-11-02T20:29:33.792105Z"},{"id":"CLSA-2026-1790071189","title":"TuxCare security update for org.springframework (35 CVEs)","description":"TuxCare rebuilt 10 org.springframework packages to address 35 CVEs. Fixed in 5.3.23-tuxcare.1.","status":"published","published":"2026-09-22T09:59:49Z","modified":"2026-11-02T19:46:20.152967042Z","updated_at":"2026-11-02T20:29:27.085992Z"},{"id":"CLSA-2026-1790074384","title":"TuxCare security update for org.springframework (34 CVEs)","description":"TuxCare rebuilt 10 org.springframework packages to address 34 CVEs. Fixed in 5.3.13-tuxcare.1.","status":"published","published":"2026-09-22T10:53:04Z","modified":"2026-11-02T19:46:21.573735323Z","updated_at":"2026-11-02T20:29:27.085992Z"},{"id":"CLSA-2026-1790102819","title":"TuxCare security update for org.springframework (25 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 25 CVEs. Fixed in 5.3.5-tuxcare.1.","status":"published","published":"2026-09-22T18:46:59Z","modified":"2026-11-02T19:46:20.237563172Z","updated_at":"2026-11-02T20:29:27.085992Z"},{"id":"CLSA-2026-1790123797","title":"TuxCare security update for org.springframework (25 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 25 CVEs. Fixed in 5.3.3-tuxcare.1.","status":"published","published":"2026-09-23T00:36:37Z","modified":"2026-11-02T19:46:20.664848902Z","updated_at":"2026-11-02T20:29:27.085992Z"},{"id":"CLSA-2026-1791218487","title":"TuxCare security update for org.springframework (28 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 28 CVEs. Fixed in 4.3.21.RELEASE-tuxcare.1.","status":"published","published":"2026-10-05T16:41:27Z","modified":"2026-11-02T19:46:26.185897679Z","updated_at":"2026-11-02T20:29:22.637147Z"},{"id":"CLSA-2026-1791289094","title":"TuxCare security update for org.springframework (31 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 31 CVEs. Fixed in 4.3.16.RELEASE-tuxcare.1.","status":"published","published":"2026-10-06T12:18:14Z","modified":"2026-11-02T19:46:26.292239404Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1791463819","title":"TuxCare security update for org.springframework (36 CVEs)","description":"TuxCare rebuilt 10 org.springframework packages to address 36 CVEs. Fixed in 4.3.5.RELEASE-tuxcare.1.","status":"published","published":"2026-10-08T12:50:19Z","modified":"2026-11-09T19:28:37.080317508Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1792590655","title":"TuxCare security update for org.springframework (29 CVEs)","description":"TuxCare rebuilt 10 org.springframework packages to address 29 CVEs. Fixed in 4.3.20.RELEASE-tuxcare.1.","status":"published","published":"2026-10-21T13:50:55Z","modified":"2026-11-02T19:46:30.234656173Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792590787","title":"TuxCare security update for org.springframework (29 CVEs)","description":"TuxCare rebuilt 12 org.springframework packages to address 29 CVEs. Fixed in 5.1.19.RELEASE-tuxcare.1.","status":"published","published":"2026-10-21T13:53:07Z","modified":"2026-11-02T19:46:29.631616099Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793098737","title":"TuxCare security update for org.springframework (2 CVEs)","description":"TuxCare rebuilt 3 org.springframework packages to address 2 CVEs. Fixed in 5.2.17.RELEASE-tuxcare.3.","status":"published","published":"2026-10-27T10:58:57Z","modified":"2026-11-02T19:46:32.348095904Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793615375","title":"TuxCare security update for org.springframework (7 CVEs)","description":"TuxCare rebuilt 4 org.springframework packages to address 7 CVEs. Fixed in 4.3.26.RELEASE-tuxcare.3.","status":"published","published":"2026-11-02T11:29:35Z","modified":"2026-11-02T19:46:33.217667376Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793615948","title":"TuxCare security update for org.springframework (17 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 17 CVEs. Fixed in 5.2.7.RELEASE-tuxcare.3.","status":"published","published":"2026-11-02T11:39:09Z","modified":"2026-11-02T19:46:33.374523015Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793616969","title":"TuxCare security update for org.springframework (16 CVEs)","description":"TuxCare rebuilt 9 org.springframework packages to address 16 CVEs. Fixed in 5.2.9.RELEASE-tuxcare.2.","status":"published","published":"2026-11-02T11:56:10Z","modified":"2026-11-02T19:46:33.125808392Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793620971","title":"TuxCare security update for org.springframework (13 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 13 CVEs. Fixed in 5.2.10.RELEASE-tuxcare.3.","status":"published","published":"2026-11-02T13:02:51Z","modified":"2026-11-02T19:46:33.689179074Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793625740","title":"TuxCare security update for org.springframework (7 CVEs)","description":"TuxCare rebuilt 5 org.springframework packages to address 7 CVEs. Fixed in 5.3.18-tuxcare.3.","status":"published","published":"2026-11-02T14:22:21Z","modified":"2026-11-02T19:46:33.674785839Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793881017","title":"TuxCare security update for org.springframework (11 CVEs)","description":"TuxCare rebuilt 7 org.springframework packages to address 11 CVEs. Fixed in 5.3.19-tuxcare.4.","status":"published","published":"2026-11-05T13:16:58Z","modified":"2026-11-06T13:15:03.926485709Z","updated_at":"2026-11-06T13:44:21.739016Z"},{"id":"CLSA-2026-1793881978","title":"TuxCare security update for org.springframework (8 CVEs)","description":"TuxCare rebuilt 5 org.springframework packages to address 8 CVEs. Fixed in 5.3.20-tuxcare.4.","status":"published","published":"2026-11-05T13:32:59Z","modified":"2026-11-06T13:15:04.87153289Z","updated_at":"2026-11-06T13:44:21.739016Z"},{"id":"CLSA-2026-1793883499","title":"TuxCare security update for org.springframework (18 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 18 CVEs. Fixed in 5.2.8.RELEASE-tuxcare.3.","status":"published","published":"2026-11-05T13:58:20Z","modified":"2026-11-06T13:15:13.169324833Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793885497","title":"TuxCare security update for org.springframework (13 CVEs)","description":"TuxCare rebuilt 7 org.springframework packages to address 13 CVEs. Fixed in 5.2.11.RELEASE-tuxcare.4.","status":"published","published":"2026-11-05T14:31:38Z","modified":"2026-11-06T13:15:20.810473169Z","updated_at":"2026-11-06T13:44:09.891978Z"}]},"sources_more":{"osv":2}}