{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fa320ee2-37be-5592-882c-03dd90ef8fca", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-instrument", "purl": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11", "version": "5.3.29-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c733f89e-5d1c-5347-96f4-926311f25bf8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.29-tuxcare.11 of org.springframework:spring-instrument and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9d4dcb14-d397-5bf4-ba83-892e163bf526", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d2d04f9f-212f-5624-8bfb-3e31d7f5291d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f03d0c2e-b4e1-5326-8ba1-4e9366e491bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a6bb17c8-41cf-5b33-a3d0-15a05d85eb27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:39461c15-c7b3-549f-a224-8208192a0a92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:daa8468a-48d8-522e-8c7b-51c0395d905f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2f1a5095-d869-5787-a276-45438573adba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:401ba7a5-d69a-53e9-a9b5-d2397a7db6dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:638c2fe9-12a3-5849-b33d-1593909bd04b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4b2245cd-9ddc-5e68-b19a-98c388811f6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d312053e-d671-55cb-bf82-9070b42bf9d6", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-instrument 5.3.29-tuxcare.11." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:889f3fee-b13c-5459-91cb-26cfd100c5d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:010ac2fa-8dc7-572e-a9c4-37a3192721bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6c23f1f0-86d4-5fe1-9e17-f2ee943fd0f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ae92b440-29e4-58a4-945f-ae4b077624ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:eb0de1e2-b259-58a7-9d39-4b1d4a5b94e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b55bce35-7d6c-53f3-afe7-5721a14f27c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:49a2bc7e-9288-52b5-97f6-7db65f492eab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2f5d4b06-297f-5e19-97d6-2d52814dc2e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:98a6f1c9-c600-5369-8641-4937800031cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c09a4bf0-c7b6-5c0e-8803-d6a931a9e118", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:02108e29-a162-58cc-b03a-5bb68c2d82bc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-instrument. already_fixed \u2014 The target repository (Spring Framework 5.3.29-tuxcare.4) already contains the complete fix for CVE-2026-41840. The fix was applied on 2026-05-19 as part of a TuxCare backport for CVE-2026-22740 (commit bc0026ae70c), which addresses the same multipart request DoS vulnerability with identical code changes.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2811a35a-2176-516d-a429-f3267b4bf832", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:dbc05d50-8f9f-528b-bfd6-ef99031ddc30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a6abeda9-65a1-5f0d-be7b-e8d46e11424a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c28cccfd-b6af-5d49-acb9-b646a1d7fa13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:82a599c3-4bab-53a4-bab9-295b6c2fe587", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2fd7ecbf-bbc5-5e57-bbac-f2d0b1267f47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:500b7f55-bd5a-5048-a3d1-0fd30c2c8626", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:25494670-4347-5163-9ca0-f785b95f26b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:680261b7-aefe-52ef-98e0-0b6004f11e54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:de1fbde1-d4ab-5057-913d-96a9a93588d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c9c36085-a722-557f-b28a-412a603ca457", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1d83d7e0-ec31-5829-a44f-1a8e9fab4910", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b53c3aa1-6f69-551c-8f79-02b1afa552ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ed9e89a3-f8be-527a-b188-c046e5264990", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:5e9f7287-b59a-57eb-9a87-059db76348e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bbd31f50-c316-55b6-973a-1cb9cac3b391", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:999bbe97-9354-5e45-803c-0bcebf050f02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7b9b6516-5e10-527a-8cf0-57af8386178a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bdf79520-fe25-5147-9077-0b1ed0379169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a9f74c51-51f6-5e23-b785-31a48b1f051f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7fe6b592-81d9-5ca6-82a2-16b5d70593c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:427ba6eb-fbfb-58a4-8219-c940a3d78a1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:fc00ea69-e86e-5b50-8e17-1e83532a7ec6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bf5fb0ac-152a-55ff-9885-2311c67bd258", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b2357b9c-0e23-5090-b35a-23f5339d6f03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0a741a5b-f817-566b-a390-07a2291d13a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:99137638-b877-53f8-9267-a3dc9bec7767", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6cdc6966-75c0-5c64-acba-a05c1e1125a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-instrument." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.29-tuxcare.11" } ] }