{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c5609bd2-b9aa-5f3b-b666-af6618b5e705", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-instrument", "version": "5.3.27-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f6e3c4c5-f0bc-5c62-b4df-6c2306685ed3", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:654ad05c-9233-5753-a42b-93c3c7dee732", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d4399a48-78ec-5300-bb09-564732471c66", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6a6065fb-0be4-54cd-8ef3-0f0e9991a157", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f28f14dd-0804-51b1-ac85-5b544b04ccc9", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9b4bd819-354a-5c21-89f1-79ce1d6a1e66", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1f440ed6-f8cf-5a96-8a13-eebe735b1122", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bc85c729-1038-5eed-bf86-b027dcffb82d", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0b87257d-083d-5370-be5b-02fd5089ce7b", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7247667a-f541-5f53-b68b-fc1e314286f2", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6d644cf8-a808-55a3-bdf6-754b5fcb9373", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6a4e75a6-2bcf-5fb9-a390-2cb301eaa801", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-instrument 5.3.27-tuxcare.6." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7d86b93c-e336-5344-bb37-a5e332f01dae", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e926be31-241f-5e4e-b5b5-a4eb6c6d0d1d", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:280b6ad3-6545-5ffb-b217-d85deffcd0a8", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:26436324-bacf-5922-9314-ea93ae1e4e92", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:08e8444d-85c2-584c-b108-2d43cb9dbf0d", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8218ae3c-365a-5b54-a43e-a36e21be5dae", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:de94586a-577f-5969-b83b-5e8cb1a10df4", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5f05114b-b888-5524-9787-87fc55b230aa", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:441b7f2b-849b-5079-9cb7-35e8fe2416c2", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8ddb906e-303f-575d-a6ab-8a83c33874c6", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e8a53551-59a9-5c80-a849-a80a14d9446f", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.6 of org.springframework:spring-instrument. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b4517dc6-0093-5309-a705-3194eeadbf71", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b9837041-705a-5a4c-8605-5b20e65462bf", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:cfe2d772-fc9a-576d-936c-453c7817810b", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:06d7745b-ba45-583e-9811-3d073635b95e", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7bf6e5ae-7fb4-5e81-9115-80c54c9aeabe", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c04394c0-bdf0-5484-baf5-b6d1e688a425", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:88764266-f2d3-5805-8f17-7f4911ce13d5", "id": "CVE-2026-41847", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.6 of org.springframework:spring-instrument. All 1 patch commits already exist in target branch" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:49018087-69c1-522e-85ae-1bcd5aded6ac", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6e13cdae-ec26-5e6d-95c7-55ddb6ad3a4c", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9c380101-62e6-5ea4-89cc-cbcc712c5536", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:de4565d7-1853-5b22-9684-da16c3cd8eb9", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8648c8f2-e1a6-5029-bb3c-236777966ea1", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1e8d82a2-9c58-5425-8b8e-41a244126595", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bf10959a-c7af-5974-b5ce-57d6d37f1c4b", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.27-tuxcare.6 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.27-tuxcare.6" } ] }