{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5c19d1f8-dbf3-559e-b025-293858ac182c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-instrument", "purl": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12", "version": "5.3.37-tuxcare.12", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:89d0dd07-5ec3-5c66-9566-2a9527b9a0a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.12 of org.springframework:spring-instrument and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b13d4689-ef63-5b14-84be-7d17d7d63604", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:dda8fa0e-ed43-55da-a978-5def63f9d695", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b2ec5936-930e-52a2-b4b9-f0602e3ceb72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:43027aff-2f28-5922-8ab0-3905a6896836", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:5f83c9c5-b40f-5e3e-9613-a577a1376b21", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b89c80b6-00c0-5b58-86eb-4bac1991bb32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:4f3b722f-04a3-5662-b278-160f153361e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:a275dac0-38c1-58d7-8c67-e56e03407002", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:35b426ec-b5f6-5fb8-89d5-752538d1c4c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:a54cac84-28cc-5319-b374-ac9bb0c9b21a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:76a78fd8-2e87-5632-8ea7-934426cd98ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:bd0c1843-96e2-549d-b07e-af625bc0f701", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:1069520b-30f3-5250-88c3-64f58ac49ee1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:45a24888-1746-58d6-b040-b9d850b5c9a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:8e4727fa-43bd-5928-b1bb-ec2c95db9495", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:30d5f518-0c51-581b-89d6-dc1468897c3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:dfd42329-a515-56f0-83ce-8302d4d63841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:88a2acc8-9ed6-5921-947a-8405ee14f7ec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-instrument. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:6862433f-873f-50d3-b6b2-2fe4eadaa169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:ef0d3aed-e63e-5340-85d9-4475deec6f68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:d7cc6a89-1b84-529b-a29d-d37160f6f91e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:6f56a7ce-be74-506f-b8d5-179bbaeb65c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:5fb5f5bc-2f8f-5dc5-a91e-8ffc84bd956a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:323de0c5-0b4e-51fd-ba5e-901eb36eb58e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:a3e35088-db6d-5fa8-8989-fd165f96ceec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:73eaee18-105f-55c2-9bfc-274875cc95e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:0eaf4225-8191-58df-803e-adc936eb8e06", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-instrument. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:2c9fed1d-7acf-5e17-b6ec-7efe61af0bcc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:bb5fc2dd-f386-51ed-a23e-eec2a584db5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:e8095c77-5fd7-5389-a56b-2725a54cda98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:c42ffaf6-e91b-585e-9bc9-db2d63bf2a17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:169cf886-5a38-5087-8110-d93879a374c0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-instrument. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:921f923e-caef-5446-8ac7-a455e58ebc42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:4bf0a6d8-0dfe-5eb0-84f6-20a3dc32fd57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:fcc1675f-ccc5-561a-8ce9-8bdc06eba3ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:18dd6f2c-b3c7-5ba5-9a68-d5d9999929f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:2d345e0f-d004-5399-9e42-e5708048e931", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:08e2f03b-8147-5fea-96e7-8f0396eceec5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:30d4c88d-5d2e-5c31-be46-9c15d59fd6d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:25dd9c8e-1e12-5faf-ba43-f90c20cd8ade", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:38d73cca-373c-5a3b-b839-2afa9e7f3f22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:66240c6c-31ca-5f79-aee9-a4eeb03db653", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:91c8a89a-755f-591a-a5e7-bb8dd6f29dcf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:d4f43065-265d-5af0-8c51-4c02a1d3011b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:0768c140-820e-5f4f-8350-868b5a90f8e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:c25c35b9-8548-567c-b3b1-b1004693a76b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-instrument." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.37-tuxcare.12" } ] }