{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:5f8bcc90-8855-52ee-b5a0-9c7979670cc5",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8",
      "type": "library",
      "group": "org.springframework",
      "name": "spring-instrument",
      "version": "5.3.31-tuxcare.8",
      "purl": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:a9169946-656e-5c72-a480-54ee8f55bb0c",
      "id": "CVE-2016-1000027",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4aa4823a-13b0-519c-9922-2336ed2222bb",
      "id": "CVE-2024-22243",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:278a98ff-4e79-5a80-968f-233acc2304a3",
      "id": "CVE-2024-22259",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:de83068a-7e88-5c1b-b732-a1aaaa1e82c1",
      "id": "CVE-2024-22262",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:82cf2fec-9718-56f9-9668-7180d5dc424b",
      "id": "CVE-2024-38808",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:46e4b2af-80c3-5736-bc55-19fbdbcff49b",
      "id": "CVE-2024-38809",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f25ea984-a3f4-55b8-80b6-85ba74527609",
      "id": "CVE-2024-38816",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7b057e50-c379-5988-8535-b780c3b260a7",
      "id": "CVE-2024-38819",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5e56d9dc-cc5a-5879-8fec-a538a4d84cc0",
      "id": "CVE-2024-38820",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cd800de0-e625-512c-a13f-c09d5057c138",
      "id": "CVE-2024-38828",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f01ae352-56f7-5dc7-b317-038af5090ac1",
      "id": "CVE-2025-22233",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:49caa14f-8c89-5c2d-9547-703ceebaded8",
      "id": "CVE-2025-41234",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-instrument 5.3.31-tuxcare.8."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:28a1b615-b534-5948-9d08-c1015c3415c5",
      "id": "CVE-2025-41242",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:91ef9e38-e606-5565-ae77-3945dd171c44",
      "id": "CVE-2025-41249",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:db9f20a4-b677-538f-800e-448097cf819b",
      "id": "CVE-2025-41254",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:266cadaa-1278-526a-915d-aff3871bed69",
      "id": "CVE-2026-22735",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1f44f625-6d79-5f63-989b-d39129c57005",
      "id": "CVE-2026-22737",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c1ca7ca2-ad18-51d1-a106-bdc5c69b3976",
      "id": "CVE-2026-22740",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6652289d-14ba-597b-9c10-8ce8aac19a19",
      "id": "CVE-2026-22741",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22741 affects version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:131e8cc6-8f24-5527-98b8-aca4edf8fe80",
      "id": "CVE-2026-22745",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d9fd482e-217d-5d68-9c15-81d8133a47ad",
      "id": "CVE-2026-41838",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1346156e-7808-5f46-81de-a9e2869c44e1",
      "id": "CVE-2026-41839",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6aecaac1-2ca8-5e08-b63e-5f635e5e461c",
      "id": "CVE-2026-41840",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.8 of org.springframework:spring-instrument. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f6e868f5-97a9-5b25-8e6d-c3ccaca8712f",
      "id": "CVE-2026-41841",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41841 affects version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c309ddc0-2cdd-5efc-ae01-71b2ccaea9a6",
      "id": "CVE-2026-41842",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41842 affects version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3d7f89e6-4736-546b-8762-88fae59d35a6",
      "id": "CVE-2026-41843",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3f92171e-8409-5e22-bf84-1202a9bee966",
      "id": "CVE-2026-41844",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:48f32336-ede2-59d1-9b0d-1e3b7c1cafd1",
      "id": "CVE-2026-41845",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8bb2501f-e6e6-59b9-991c-dd442973b1e4",
      "id": "CVE-2026-41846",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41846 affects version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4fcf447d-31a4-5a99-b4f3-514b79559653",
      "id": "CVE-2026-41847",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41847 affects version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:717d16f3-231d-56cf-9a01-2991adc39235",
      "id": "CVE-2026-41848",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b0ab48e8-368a-5ac1-bcf0-f9b1070a0587",
      "id": "CVE-2026-41849",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6d8e12ab-88b4-5a62-a0c2-e8ca888b26df",
      "id": "CVE-2026-41850",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:41757bbc-e178-535c-b280-3354bc426b02",
      "id": "CVE-2026-41851",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e9097664-16f4-59c4-9a66-fa7dc9c9d71e",
      "id": "CVE-2026-41852",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41852 affects version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3625b524-c42d-58b0-a539-326c3e9504ed",
      "id": "CVE-2026-41853",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b004331d-786a-5bd4-b6ba-aa1bfc702425",
      "id": "CVE-2026-41855",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.31-tuxcare.8 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.8"
    }
  ]
}