{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:989e4013-a903-574b-9a41-4304615ac660", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10", "type": "library", "group": "org.springframework", "name": "spring-instrument", "version": "5.3.31-tuxcare.10", "purl": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:6d6bca91-0da8-5389-b87d-c0450d07e9ec", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:b719e310-5637-5445-834b-5fa2b6068498", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:a82024fd-80b7-5933-ab87-3d0cf1d30f34", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:ec1c6a61-bb73-5de2-9172-8adddd30c850", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:f95f90c2-0a29-5afd-b37f-f6bfd1eef662", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d26aba47-a053-5a14-ab3e-ede278103c5d", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d8a60a96-7d09-5874-a55e-d162390a5cf1", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:3c415920-251f-54e9-9071-668569a8395f", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:55be5a64-a93d-546a-a812-210fa2d77da1", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:72871de3-1889-56c9-924e-6d85eb5b64ba", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:7316c4c1-1b1c-554c-8299-31af2d6dfb8b", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:8e271942-d871-57c6-bc98-14bc3970ce60", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-instrument 5.3.31-tuxcare.10." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:5c03ce2c-eb0c-5ad4-9610-f0bcb2500452", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d2e72a77-bfbe-5ab6-827c-83025fed9722", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:535e6022-3582-5f31-bfab-fdbe24df026c", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:cd062490-52c8-5cc4-bf5c-b7f3adaaebe9", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:b8081c18-20f4-5b99-bba6-ab0735ed55b4", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:7af7f871-0249-58b1-94a8-c1e8a5939bcb", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:0d677feb-c6f6-56d5-946e-803f04a8c958", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:928dfb97-90ea-5c21-809c-0ccd123b0f06", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d4533258-00b9-5c4d-a440-5581e690ab04", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:80ede37a-333c-52d2-992f-ead2a5c75638", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:634e2a2c-759b-5759-abb1-8886f89866ad", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.10 of org.springframework:spring-instrument. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:5288d827-9dc0-54df-ac74-665d616765a4", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:b5256e28-a96d-5fde-91e3-d21bf72141a3", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:27d1be92-39ad-5583-a65d-41f88c04e9bf", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:578dc88b-ed4e-50e6-bbca-6b3066cee729", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:c83e9836-1ce5-5e94-99f8-dc39fb64c838", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:fe430725-2f6e-5c54-98d2-38722e99df56", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:454b4059-29e5-5c92-9d71-8552676ee633", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:04314503-8d4d-527b-92fc-8c453c875b91", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:1d6c6250-cd33-5149-9514-2514cc93dda2", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:0f344bfd-48c9-5363-9e69-25fa205c3d89", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:10cd5566-f249-581f-9724-9f318636edfe", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:4fb3f5d5-2917-5cdc-bf75-b6e9eaa345e4", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:ee65399c-e998-512d-baee-01c878a61fef", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:f1e07ea4-ef74-5168-939e-6ec8f494e3a8", "id": "CVE-2026-41854", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:15613863-f59d-53f8-81a0-6b31e7af4a10", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.31-tuxcare.10 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.31-tuxcare.10" } ] }