{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0e5de242-7939-518d-97f3-7c78346bb7b8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-instrument", "purl": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9", "version": "5.3.24-tuxcare.9", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:3ea1a408-4b0e-58d1-b5f4-80e86dcae640", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.24-tuxcare.9 of org.springframework:spring-instrument and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:70242515-87a3-566b-bedb-a062860c7144", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20860 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:6d696428-5ce2-5d38-8a2a-ae50a6d204d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:31c7ff01-0fd0-5ae6-9e04-01c4af47926b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:779ab3b0-14f6-5142-a091-930621dabd76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:257ed5d3-90a3-576d-a86e-8cea20242a92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:d5c5b910-2a83-5ab8-b07b-a06a4645361b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:22189283-7144-5b25-81db-af27e1756a47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:aab0c57a-a391-55d6-95d7-f7c284e7e332", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:007c873e-a92b-52ef-8ffa-f7eef7e90939", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:cf38b6df-ee85-5740-8186-5a512301c2b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:458d23d2-3aee-56a8-8d38-537fc0835b93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:07a28376-bea4-51f3-bf14-73dc9301390b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:4871c4f1-5646-5309-aeae-97751b37f701", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:31f52cd9-a57e-53d9-bdec-526459e38449", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:1aff68b0-1c61-5cd0-84f6-e309687481e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:5b0075d9-e4e9-5325-9f02-fe60c3417297", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:1f0c5ec3-6fca-508e-b84a-408fdaf577b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:6034f9b2-dea5-5abe-bc7d-79f105064e6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:8c537de0-67f0-5ef5-9f50-c08bc9665239", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:f40195b2-d1a5-5392-945a-e0d8f3a56535", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:9dc5b048-94e5-5052-9ef4-95cac00e8f5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:6c17231a-9b0e-524d-99b4-d3886db288ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:ea0ab405-5f2c-5362-b4aa-ae1b61b74bc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:8d45d4de-a5e1-5bfa-b27d-aac0f42954e4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.24-tuxcare.9 of org.springframework:spring-instrument. Patches already applied: 7052da453285658215efc1dd5ecb0d472fde2de1 (already in target via 2c11852775 'Backport CVE-2026-22740 to 5.3.24')", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:48d66517-4a19-53d5-8956-e84ec413019c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:161ef170-4d7d-5abe-90c8-5d3cfde89e4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:a75e541d-bfee-5507-b944-1d440feed701", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:603499a3-8949-5d7b-8eca-8493b360a4ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:23b9683b-4564-5c17-a1b4-2daf2ee343e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:8ab59629-23aa-5d16-bf8b-4e147e1ef750", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:e00f14db-155d-5cec-9a34-238ad0aacff3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:b5d6876c-b7b4-5540-9838-45cbd8827532", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:c50a4aff-17b4-5da8-a05b-49f5ad09cff0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:fb97c4fc-2bed-52a4-8236-e2ca6588e572", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:d5b892dd-a2ae-5a04-81d5-4366bd7bf365", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:21672648-5112-5be3-ad98-65c2f74d498a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:2c002636-6e55-5bc7-8044-6fa371fe422f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:b77becdf-635f-5c20-9e98-4d34157fc8d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:ddd53b5b-aff3-53d4-a4f3-ecee420843f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:5072b685-e151-54f0-9a18-cc326e812248", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:5373c7e9-f692-56ad-803a-cf3ae66ab112", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:c7c17d63-dedc-5d9b-a646-95192a4b4388", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:4f70852e-0d6d-5ecd-9536-bd3ce020bf89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:fc91999a-1368-53b1-8018-223ba0e59c86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:60797a77-6a38-54a5-83df-b85a56b0bea0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:96a77502-301d-5f9a-afcf-1e39c8fe24ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:c20637a9-04dc-5603-8ed6-e725049d0350", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:43617acb-0a95-5ef1-9caa-f185d9dda046", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:78dda6b9-851e-5207-864f-013edceedf3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:06bf222f-fa48-5877-a2ac-bc118a445ad4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:bbcad05b-1aee-52db-8fda-85c2ee0104c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ], "bom-ref": "urn:uuid:7e10bbeb-9c90-5b5c-8dee-d4ed1b1a00ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-instrument." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.24-tuxcare.9" } ] }