{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:19511cb4-9c60-559f-b731-0c6e87e847d1", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4", "type": "library", "group": "org.springframework", "name": "spring-instrument", "version": "4.3.30.RELEASE-tuxcare.4", "purl": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:634c930a-22f2-5674-be0b-4bf8f0d420ee", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8e887a0b-7348-56ca-8f57-2efef53982bd", "id": "CVE-2020-5397", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e4728c03-56dc-562c-9545-70bb7a1f4bcd", "id": "CVE-2020-5421", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument. Version 4.3.30.RELEASE is not affected by CVE-2020-5421: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 6327c60912cd80120040c8c16c3731d8bf6c19f6\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a89925b9-41d8-5425-97e3-36c2f7faec3a", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c6d9c9f8-a6f8-5dc7-bb57-5d025eb8ae45", "id": "CVE-2021-22096", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4119d759-228a-53c5-9c07-41b97c4a6c4b", "id": "CVE-2021-22118", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument. Version 4.3.30.RELEASE is not vulnerable. Summary: Target repository is Spring Framework 4.3.30.RELEASE-tuxcare.2, which predates the introduction of WebFlux. The vulnerable code (reactive multipart handling with predictable temp directories) does not exist in this version. CVE-2021-22118 specifically affects WebFlux applications in Spring Framework 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. WebFlux was introduced in Spring Framework 5.0, and the vulnerable multipart han [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2ad0db5f-8e80-519a-a29f-e7d8816f72b3", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:800e73de-3ef2-5702-ac70-23780a8097e6", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:88aa1507-2777-5771-8082-7c95e327eb84", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:bdb25c96-0393-5d8a-b2ce-d5ebc5fefa48", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:40db0444-f61a-583d-9eed-04e27e034a3a", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fe05475d-49bb-565b-8c86-0a4a0d8286e9", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:54d80a76-17e5-5176-a3e6-389cfeceddd8", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:df8b65d2-01e6-578e-86f4-3ec81e7e104c", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2543e2f9-9639-56a4-a3ae-edecb98a840b", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:edcf1243-cad7-534f-9454-83b6c5d4e7ee", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:440c8609-7733-5a1b-b562-9e82f831b19d", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9bda1521-1d28-549e-8ccc-a92a07e9293b", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:875e8545-a94f-55d8-bd1c-87a4231ab32d", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fb91a2d0-304c-5f7e-8949-43ba9682fa77", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b461d284-f224-52b3-8cf4-a11ae9245bba", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:17534f07-1c7b-5398-a91d-5b472d07d73d", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3d1c9f81-f883-57fe-ae57-caf071f083c7", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:3e8ddf52-2d06-5cea-b864-b048d2a723e0", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e6f91fbd-b559-559d-9c8a-86d1a30b71fd", "id": "CVE-2026-22740", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 4.3.30.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 4.x is not in the affected range." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:15447280-e278-5f12-94ef-63404827ad69", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:45c91f1e-8e1b-541b-951d-8c7248a1ef76", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5bc50030-931d-5b60-a816-44f3e38c4bf3", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:533a5618-9566-5aa9-a3b4-e8d660914d5e", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9dfd85c7-dd64-520a-8d47-dc55cdec97a2", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9cb99fb7-529b-537d-81ea-0a2dffb893c2", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:885e894b-1117-53fc-ba69-8a4c308a7b4c", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:56829946-ba16-54bc-bca2-46e1db909750", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:338eb1d4-4fa8-5056-a0a8-206de6af53b1", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:60d706c7-e1ed-58cc-b99a-b89f38b7c37b", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:64065fd5-a161-524c-b5b5-23f064f78822", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:164af5bf-881e-5dfe-83fa-588b87a2db58", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:36a26503-abeb-5abb-a81b-eb188b6ae58b", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b3e3fd57-8a06-5017-8a1c-17c28b5b2ecd", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:69194620-8a2b-546d-9532-50a10ed7d064", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument. not_affected \u2014 Spring Framework 4.3.30 is not affected by CVE-2026-41853. This version predates Spring WebFlux (introduced in 5.0) and lacks the vulnerable component DefaultServerWebExchange.java. The vulnerability mechanism - Spring Framework's message reader selection based on wildcard Content-Type headers - does not exist in this servlet-based Spring MVC architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:50e5860d-8c2d-5f9f-923d-9ae989c904cb", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ff779ddd-d0b6-5cfa-b811-954ff656aaee", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.4" } ] }