{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:86dfc748-1adf-5dd7-a58f-cd80b069cac8", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework", "name": "spring-instrument", "version": "5.1.20.RELEASE-tuxcare.3", "purl": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:c6dacdc6-79fc-580f-868b-0dc2a2b9ada4", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0f6942bf-6c99-56c7-82c7-beb1e4c07bc6", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:dab427c7-a110-59e1-8285-66973d0ded98", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f87d4a8f-d91f-5a8d-9f8b-73ac4bd2aacc", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:069b3d39-d336-513f-be1e-4d6ec1f9efe2", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9ba75cde-c177-5a87-b914-77a3ccf156bc", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:de85520a-c5f6-5b92-a698-4c6b3b47ede3", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5ec6b276-d489-500a-bb53-f9121d4cbfe4", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:783c7b4b-2fec-5066-99bc-0300fd76d11f", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f5bc7409-13bc-51ff-a0d8-078eee46f7d2", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ee434710-6dd6-533b-8f69-3d867a55f1c4", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c87ef048-159a-5f66-9cfe-20bca4e0828e", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6ff11554-108c-5c6c-8cf5-176a7e7ed5bf", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fd37da3e-731b-5ec7-8223-6863e08c613c", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:76d05c0e-1b55-58f0-bf5e-22eafc1a954d", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1a1cdb25-9ef0-5724-90b5-b3fa0b02d379", "id": "CVE-2024-38809", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-instrument 5.1.20.RELEASE-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7cd1aa96-b819-588a-ab06-5b9b80903cf2", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:214f29c0-a452-585e-81cf-1126be7736da", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c52b058d-0282-5fb0-aa56-3eb962492645", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:7def0c50-bf84-51dc-ad03-295979701f07", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:41e68f92-7417-5fca-9129-bafbe6292a36", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:421f3762-ec6a-56cc-89ee-8cf54ce649a5", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:26d880c9-045b-54fe-8506-7c04346680f4", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:44adbd4a-cbc7-5007-945a-926913a0b5d2", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ce0fec9b-f5e2-51d8-82c9-49685635315c", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:426694ad-01a0-5838-bfa9-9b671d73dd2f", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4b8bcaa4-0625-5484-904a-c17e0ed9d23b", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e6ee4447-a9a9-5a77-9550-f82d5c1d6581", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:022d6b6e-2956-51d5-b532-b07619e7f31c", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8c8179f9-d1a7-5577-beb8-883720b724ab", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:dd1f6d1b-47c5-51cf-ac62-3db9f8102998", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2de14dac-b3f0-549b-a518-5bae37c2a6ce", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8df0a5bf-df33-5503-99f1-1d7a7b78fde7", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:49d202e6-1465-530f-bc14-0ad87dd2ba99", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:6d843f6e-28eb-5d69-b8bd-2447d2955360", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9f0f2dd7-f701-5b35-8eed-9d7a372a0c91", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:fb4ef199-33fa-5cf2-904a-5b58ed938486", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e2dadaa8-b4c6-5d64-84b6-997fd5b3c5be", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ffc78c59-e939-5e38-8bd6-30968e389e1b", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:91554cc0-56e1-524b-9fe9-29863bdf075a", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:cd9ffb45-3c84-59f8-b8c4-7929f767e198", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:be58f9ce-eda3-5afa-8238-f796c8b86df8", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.1.20.RELEASE-tuxcare.3" } ] }