{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4c7457ca-059c-56b5-97b3-da6545abce33", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10", "type": "library", "group": "org.springframework", "name": "spring-instrument", "version": "5.3.30-tuxcare.10", "purl": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:7cd03676-8a6b-5bbe-8b0b-1cbed7271ac9", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:299f1f55-7a32-533c-aacb-3c42116af142", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:70971fc3-56bc-53fa-a639-4b0be9e3f81f", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:347941e4-b84a-52d0-98e5-d11f30f52494", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:9bc0e549-5821-52a3-a8d5-fa2e5b504482", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:7387c657-a2cb-5479-a02b-ea3aa189080b", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:3b3cb29e-0bb9-5bb4-9636-f7bbb8cca2f3", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:464ca6c6-a80f-57ac-8442-e48a3035f0c0", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:bf6363a0-e675-517e-b993-cf698d8f4207", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:67ee49c6-d6c1-50a3-913c-d10db8c3b930", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:1c39e12a-be0b-5dec-bf83-d6a4d1a163b7", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:61330800-6287-573a-bdc2-b04b4875a2c2", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:e0ed368d-b4ae-51a7-a0bc-3db8e29935af", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:07fbcc7e-7c16-5cc0-9b36-2ef9ce245059", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:5616fe34-c54f-5492-b42a-101763a9c420", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:7a0c1912-34a6-5576-84d4-4b9ff577c308", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:f9d649f3-e7f4-5a50-b794-0e85f4ac4779", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:065c298d-9b7b-58a8-8ede-b55dcfcc8fb2", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:f05f90cf-5b24-5f79-8861-e213136d7d99", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:67a7c81f-471c-5de0-af60-28ae63a05c4f", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:19abb0f5-c16e-5dc5-9385-a5eb85c21340", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:77ed8498-eaf1-5709-9167-8503175d21b2", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.30-tuxcare.10 of org.springframework:spring-instrument. already_fixed \u2014 The target repository Spring Framework 5.3.30-tuxcare.3 already contains both fixes for CVE-2026-41840. The identical patches were previously backported by TuxCare as part of CVE-2026-22740 (commits 1a619adbfb and ee9443b0bc, merged May 2026). Both doOnDiscard handlers are present in the current code: PartGenerator.java releases data buffers on discard, and MultipartHttpMessageReader.java delet..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:bfde7b2b-c699-561e-a232-2e2aabfac7fb", "id": "CVE-2026-41841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:b53cbdfc-3e97-5f21-b261-26c49468c72a", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:6225978f-bdac-5aac-8145-b9996eef0cd1", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:74cb49ba-63f9-5968-8c54-0aaa6b204b4d", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:81f4e831-f471-5731-83cb-fd56a20099df", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:a9505a7e-419e-5e83-a6a2-120cc7d583f7", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:dfb15713-6767-5303-9c33-5a0ce5984b77", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:3e579440-b67d-5f18-a6df-db44d2e71d7b", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:226a13b0-7eec-5f89-9cd1-6a869e5b5ae3", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:f5c2b660-a06f-5855-a42f-883f790d763b", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:f21f7ad8-c349-54bc-8ec3-1064571d2a23", "id": "CVE-2026-41851", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:0c07bd01-7aeb-5a99-888f-413a237c7358", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:1b310dbd-3238-56a8-957c-baff4a408931", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:cfc4870c-7b0c-5ea2-84bc-e802b1c209a0", "id": "CVE-2026-41854", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:218edb94-edfe-5118-b740-c99f6b8595ef", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:5c1207de-ff2f-5193-8833-fd7acbec8519", "id": "CVE-2026-47884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:2cb7fbfb-2498-5b6c-a3d6-34b1cda0a273", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:202adf60-4512-5e9e-b9b9-4802d5897e04", "id": "CVE-2026-47887", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:710eef60-535b-5170-87da-6fd51c9b5e7c", "id": "CVE-2026-47888", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:28849176-5d11-523b-a182-4a434fc51a75", "id": "CVE-2026-47891", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:0373d133-0f6f-5761-bb72-e45b77aa17b5", "id": "CVE-2026-47892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:bcd9517a-9e2e-5cbd-8a3a-33d1b48d0550", "id": "CVE-2026-47893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:59cd8af7-668e-514f-af48-405fea667099", "id": "CVE-2026-59280", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:ec08eae2-3522-565e-a6f0-73ad8b9d3c2c", "id": "CVE-2026-59281", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:1591749f-6eb9-5e48-abe9-bb76544f91eb", "id": "CVE-2026-59282", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:396824b0-1b7a-5e92-adaf-d710781a5517", "id": "CVE-2026-59283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:7cdd0fa4-ce48-5bfb-88ab-4736f74fb3c1", "id": "CVE-2026-59313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:6c0b5e1d-0f13-59af-b6d9-18a67f3ecd24", "id": "CVE-2026-59314", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.30-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.10" } ] }