{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5fee9f95-1fb6-55d7-b550-9093b9d82f76", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "name": "spring-instrument", "version": "5.0.13.RELEASE-tuxcare.1", "purl": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:3861a860-d3a9-53aa-885f-6ca5667c28a9", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:33c0b3d9-b9c9-5674-9ef8-41f4936c12bd", "id": "CVE-2020-5398", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5398 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:dccb787d-85c5-5c90-8712-739a0ec2b656", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ba7e151d-f92f-572a-b6e0-1f3b70fb1eb7", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3c7c26fb-f1f7-5192-b29e-4517f3b3f8f1", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ce531c8d-f88c-541c-bab3-2934c142f75b", "id": "CVE-2022-22950", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:55f060dc-ebaf-5be4-a8e1-edf85be40643", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6e7e297a-f52a-5ed1-ac35-527dc7316d07", "id": "CVE-2022-22968", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c69adad3-6e04-5e72-9c24-f0a52eb1bcb9", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fc9cfd6c-2002-5096-9b46-1154dbd94fa8", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:379fc5e4-ab6c-59e1-bb84-2672f85db287", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d5571aae-419b-5a19-88cb-e8406f8eec5d", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e42dd133-32b2-5543-a3f9-7ca617340c8d", "id": "CVE-2024-22243", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:85dfb6d8-8547-5b03-9d1f-73a64fb974b8", "id": "CVE-2024-22259", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9c67ce5b-79aa-5a2b-98ae-391c04369df7", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8523c883-3750-5c05-904d-358d462b678b", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9bfef8fd-8c7e-57d8-a524-8010d77a447a", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:03595c16-b59a-5d85-9d99-e6db201f8ac6", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:45126d75-7778-585f-b167-993d63c289c1", "id": "CVE-2024-38820", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument. not_affected \u2014 Target version 5.0.13.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() calls that were introduced by the CVE-2022-22968 fix. Version 5.0.13 predates CVE-2022-22968 and uses case-sensitive field matching without any case transformation, therefore the locale-dependent bypass mechanism described in CVE-2024-38820 cannot occur." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c998bc12-24fa-595f-b151-c4bb9371dde8", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b042274c-6d88-5d8f-9838-e27b4aa2fc73", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b2a3a4ac-5918-5ac2-8039-e47bfac5089f", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9dff5a0c-c63d-5411-8c38-a721fe8b447b", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d97267ba-6957-5d2f-8df8-b54a14811293", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:119eca24-b53a-526c-ba8f-8d3a8d5b26bb", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d0e394ab-50e3-5727-b779-dfb47c09a27d", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b9bac74d-284c-502e-bd69-a11c76ad5dfd", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8a625bf9-5923-5b56-9524-41f6dbde4d28", "id": "CVE-2026-41840", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4ef4c590-3f02-5ee7-a2f6-9f122394ae2d", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f45409e5-25cf-5616-81f8-6926730561a4", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ba6b8b8c-21b0-5df9-811e-175a50f74815", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8d0e8005-6e72-5ef7-96a1-8ab2b2e7b4ae", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:424a5744-03db-574d-a892-c1ba1234b209", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a8dde542-5d87-55a8-803f-a606558d16f9", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5449949a-cb98-5c86-9cdf-33c300e69443", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a9f60c91-9fba-5f1d-8945-3f884280e9c0", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.0.13.RELEASE-tuxcare.1 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.0.13.RELEASE-tuxcare.1" } ] }