{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:61e7bbdd-36e8-5440-bfa5-6429029f3572",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5",
      "type": "library",
      "group": "org.springframework",
      "name": "spring-instrument",
      "version": "5.3.30-tuxcare.5",
      "purl": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:720fff8c-5906-5151-830f-7c859b81b6f4",
      "id": "CVE-2016-1000027",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1b68828e-76d6-5e00-97fd-c684f5bcf4f0",
      "id": "CVE-2024-22243",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8ce04058-4c6e-5bd8-8c68-ef40e3169d4c",
      "id": "CVE-2024-22259",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8601c268-d7f9-53c7-8968-379e079f2c48",
      "id": "CVE-2024-22262",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:971eafc6-49c2-50ea-a41b-eb7e582723ab",
      "id": "CVE-2024-38808",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:43ffacd9-93e1-5851-9d82-8e99e17dbdb5",
      "id": "CVE-2024-38809",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:79d6c2e1-568d-5683-b6e0-1f599e542fa5",
      "id": "CVE-2024-38816",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4b3f2255-4b81-5435-a7ab-25871bc68493",
      "id": "CVE-2024-38819",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:432412e2-b631-5fbb-8485-58d228a5fec1",
      "id": "CVE-2024-38820",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:835226f2-af6d-5936-baee-af0eb75f28de",
      "id": "CVE-2024-38828",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:83b6fea3-4bf3-5a4d-b86c-9b35b5471e13",
      "id": "CVE-2025-22233",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0c035655-4a42-54c2-9160-734184bbf56c",
      "id": "CVE-2025-41242",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41242 affects version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c30ea938-17be-533d-bc6c-2cb864fbf488",
      "id": "CVE-2025-41249",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9b8b911d-8809-5ff5-bfb9-a8a7f9d73d6c",
      "id": "CVE-2025-41254",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6db01d29-0069-508f-8385-b761e2f9c1c8",
      "id": "CVE-2026-22735",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1ee7ce73-7bac-5830-b608-42daa9972d67",
      "id": "CVE-2026-22737",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d6b99c3e-15cf-57ad-a187-aeb7f92d1222",
      "id": "CVE-2026-22740",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:15f8c62e-c7a7-58f5-b147-4da2648c9d04",
      "id": "CVE-2026-22741",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:972394a8-4c8c-577e-8d7f-7051688b8f81",
      "id": "CVE-2026-22745",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b5d2a652-d701-5332-962b-c0df4a22d350",
      "id": "CVE-2026-41838",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1062f19b-852c-5641-9054-be2a2ed057d9",
      "id": "CVE-2026-41839",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:019761fa-eca2-53f2-87a4-6ef5a4ffac4f",
      "id": "CVE-2026-41840",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.30-tuxcare.5 of org.springframework:spring-instrument. already_fixed \u2014 The target repository Spring Framework 5.3.30-tuxcare.3 already contains both fixes for CVE-2026-41840. The identical patches were previously backported by TuxCare as part of CVE-2026-22740 (commits 1a619adbfb and ee9443b0bc, merged May 2026). Both doOnDiscard handlers are present in the current code: PartGenerator.java releases data buffers on discard, and MultipartHttpMessageReader.java delet..."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:792c8f59-12ce-5454-9a72-f7992bd7b606",
      "id": "CVE-2026-41841",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41841 affects version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2e5c1900-15ce-58bf-82a1-fea783a57f10",
      "id": "CVE-2026-41842",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41842 affects version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fbc264a5-811e-5fc7-b192-d1a92d1e9b97",
      "id": "CVE-2026-41843",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cf1b0425-2cf3-5677-88bb-4deb5e231166",
      "id": "CVE-2026-41844",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:70717bab-4ac0-5698-8efb-26a420afc2bf",
      "id": "CVE-2026-41845",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:82c704cb-f927-5e62-bd29-8af38e89279d",
      "id": "CVE-2026-41846",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:8a18cded-272e-542d-9e02-e62b774ef431",
      "id": "CVE-2026-41847",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a467a014-5405-5cbc-934d-ad0a4ca0fabe",
      "id": "CVE-2026-41848",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:bb87fadd-0362-5872-94e6-8a1b0fa73469",
      "id": "CVE-2026-41849",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41849 affects version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0772bfd2-a793-5552-8e3d-c32c4824d597",
      "id": "CVE-2026-41850",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1bb0e577-8b20-50d8-9734-7f1cf43f5f61",
      "id": "CVE-2026-41851",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7b8a7cce-cf43-5d43-bbd6-2266003083d0",
      "id": "CVE-2026-41852",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:57d559a5-a65e-5dbd-a22b-96a5f1db2a68",
      "id": "CVE-2026-41853",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e5afe4a6-a0f6-53c5-b8c5-88a43983e936",
      "id": "CVE-2026-41854",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41854 affects version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a299db7f-d189-5c21-bc56-e008fa1c885c",
      "id": "CVE-2026-41855",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-instrument."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.5"
    }
  ]
}