{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a41dae07-e05c-5ca1-a518-21bb03069c96", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17", "type": "library", "group": "org.springframework", "name": "spring-instrument", "version": "5.3.39-tuxcare.17", "purl": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:9a8eb665-2ea3-559c-ad10-bfc476ad4286", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:5ba17cfa-2781-5aa6-93fc-c319ad5006df", "id": "CVE-2022-22968", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22968 does not affect version 5.3.39-tuxcare.17 of org.springframework:spring-instrument. Spring version 5.3.39 is not affected to CVE-2022-22968 as fix has been already already backported by the original developers" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:24c555b1-143b-5948-8150-0b315c173317", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:5919c9c4-e692-519e-a43a-c9d51612dcfe", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:8d82926a-6633-5c6c-8882-635f4bfbedf2", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:6059ff43-9e7e-51e1-88b1-c17b5c84f581", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:8a493aee-b811-5a9e-976f-5f0fa2207275", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:35086d21-87c8-52e2-aac5-9f928992d440", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-instrument 5.3.39-tuxcare.17." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:c16bd729-aaf4-55a3-8277-f3025bcb2ffa", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:53eab513-91de-5eff-ab74-d3d19eadac8d", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:0deb71b1-04d8-5d33-99f6-cdc6aca39341", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:d66e1135-964e-5d37-b353-23463244991f", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:82c00f60-0b6f-5185-946f-b8debc66d844", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:56f633e1-94a2-5ce7-b9a4-a1db61c02ac8", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:3fd05170-6a2a-5592-bee1-691f98b0d684", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:e0e54c22-4dcf-50af-ac4f-a8f504c74282", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:f1605dcf-729b-5e80-8550-2cfa11631fd8", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:65495bd9-3e39-53ee-90f1-861a786a6c00", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:029a56dd-dfa0-5a07-9021-88dbb745454e", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.39-tuxcare.17 of org.springframework:spring-instrument. already_fixed \u2014 The target Spring Framework 5.3.39-tuxcare.12 already contains both vendor fixes for CVE-2026-41840. The fixes were backported via commit 4ef4cdca34 (May 13, 2026) under CVE-2026-22740, but the code changes are identical to the upstream patches. Both doOnDiscard handlers are present and active in PartGenerator.java and MultipartHttpMessageReader.java, preventing memory exhaustion from unrelease..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:27c1e990-e206-5b31-84f3-3fa974f11f59", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:482ada65-a2fd-5aac-b058-63303b1f2ca8", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:7ea0b3c6-0452-5874-af6e-0f4f2653e8d3", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:bb892d94-455a-5798-982c-d4aefa8d4e1e", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:1aebd13a-8e84-5335-9e43-05f0cac01807", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:c200c4bc-7f14-538f-a0b4-eb8569ae848e", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:42c3dd87-ee22-5448-b96e-ae04f62c9888", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:edf3e9aa-b992-5dfc-864d-04975e99066c", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:8f82e8ee-6e4c-59aa-b129-2eef6ce04b05", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:e7f6ec11-2315-5c3d-a87f-1c647ff3227d", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:27d27221-1655-5158-91f7-d69966de0f44", "id": "CVE-2026-41851", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:f7ca8581-1968-5f13-be67-cc29149bc98e", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:64aac0b7-33f0-503c-be93-47ce07e147dc", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }, { "bom-ref": "urn:uuid:457752c1-8a3c-5c80-9e3e-944fa8b7b249", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.39-tuxcare.17 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.39-tuxcare.17" } ] }