{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5c184be2-3534-5b24-a184-4067f3d39844", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8", "type": "library", "group": "org.springframework", "name": "spring-instrument", "version": "4.2.9.RELEASE-tuxcare.8", "purl": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:62fcd838-5729-51e9-b5eb-8b5a3731cbae", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:f59458a1-aa27-5cc1-ada9-7a4c8cb1c5f6", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:5b02da39-7a1e-55dd-b023-1ce7c93e435f", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d72cf1c5-1177-5158-84f1-b956711634f1", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d7ac2143-f9fc-5956-92dc-5d4e41a38ddd", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:23d8246e-df34-5bc6-bbb1-89cb8123d461", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3c7eef51-3fff-577f-ac8a-07065211d7a2", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:76de7659-33b3-5a5b-ad52-564958c8dc4f", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d34d3c18-8554-5bda-82f8-57b5b8adf8ba", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:62987b11-d146-5fe2-9822-7f7693e1b741", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:81f1f828-cb56-5ba6-a36c-742c77e2d4e9", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a59a324e-8231-58f9-97fd-95905028c62d", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:840b9697-ed7e-561f-ae11-0c44d0e655c7", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3a2d32a1-6fc2-51d3-a15f-c3ad6fa747d5", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:4269de49-6215-5b8a-9ae8-b7f185089feb", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:fcd3db44-8d40-5f2f-97b9-91bb1c7b8aa9", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:94101b57-1753-57ab-97b4-6f23cb15804c", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a0bac6b0-aa23-5ac3-96cf-aec8832534bc", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:69dde8dd-906a-58c8-9807-23615b9ef0ff", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:fd4aaead-d961-52b7-a015-2a69305ab939", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3ab71e56-0640-56ee-b6ec-72d98b0b6b3d", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:16c7a56c-445d-5b89-a9d0-94b51f2957ea", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:86fcfb75-089b-592f-9197-03e2a0d4eb39", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:951de959-488d-55e2-9807-fd7372505d66", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9853a5a8-e13b-56af-958a-9367a747b6ec", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:10d17fb3-d7e9-5d6b-8dee-4b3bc701e726", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:2796731d-116e-5f2e-84d2-79f0884052be", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:f48b74a3-0173-531d-826e-30a85f31248b", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:2e51bf7a-c7c5-5113-aa73-eb26b5050178", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1cac4c09-27c4-5a4a-9b25-25922da11c8f", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ef5a4cca-b59a-5824-9c2b-03126043db8a", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:49e7fc70-bfab-5620-a23e-89bb419d8fb2", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ff20b980-8695-5800-be1f-dec073494d03", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:291456c8-194e-504f-b719-54b51089372c", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1255ee63-3ea0-5972-9936-8318d6d66325", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:5fefe0b9-6165-5f3e-8025-a8a8cfcf4876", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:26d183ab-020a-5df7-822b-7349440d897a", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:956d4db5-5c37-5b88-ad25-3f64a85fbd63", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:f3f306c2-6f51-549c-a674-13eae580d65e", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:dc4eea95-1d58-59e5-965a-b9a83fb23581", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:5c14c6d9-c5c4-5ba8-875f-f8828d5d0c45", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:e19ed0b0-0a33-5b1f-a46c-f538c6c741b2", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a339a30f-ec46-52f7-966d-8c0d20ab6891", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:aceac78f-a8de-5c29-bb9c-0818ef8e6345", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:40e4045c-a399-5ae8-9479-8d1b8d235114", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9b68af81-6b9b-556b-a312-64958f417cf6", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:439ac33e-e26b-5c73-99b4-7def12db3b94", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.2.9.RELEASE-tuxcare.8" } ] }