{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5f39fc46-0685-580b-ad6a-07ff8c121e90", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4", "type": "library", "group": "org.springframework", "name": "spring-instrument", "version": "5.2.13.RELEASE-tuxcare.4", "purl": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:7010000a-ee60-5b80-830d-81a63f7d57cb", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6094c3bf-4cfd-5e76-8e28-e30fc09af9ae", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e363601c-24c2-59eb-a53b-60a81aeb7513", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4efba64f-f447-5cef-81a2-0e6d61adbb40", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:59426517-049c-5168-8c70-0ecf7c90dd21", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f010fda2-cffe-5bf7-be09-51e6a74fbb84", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:27c95b74-1a97-52f6-a070-12fb5e3e4696", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ed6fb793-2482-52be-ab9c-d1a0f0654ac9", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:958d5e2e-318c-5153-8f55-e6d998a1fa2b", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9030a8bc-93a9-553f-beb7-9de2ff795d11", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:272c45f1-0d3e-5a48-a61a-c316ac330230", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:59cb962d-6ade-5c6d-8bbf-1ea1c9f62c55", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a4943d59-a028-5145-a34f-04224160f68b", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7144501a-61a7-5723-a3b6-a56a87b6ff8d", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:028dd751-53ee-57a4-a227-237855df9032", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6673432e-faaf-59b1-92e3-61aba8a7a85e", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d9e16048-a2fa-535d-a1ba-3f179264c1db", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ebe6dde4-2b99-5a54-aa68-4ebb0907b2b0", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:496c55b1-c4c1-569c-8f5e-25832197b8b9", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:861dc4d7-0573-536d-972b-8450f1a8ba82", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c93ffb85-0431-5b0d-921f-a6f77b55e1b1", "id": "CVE-2025-41234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5002ff27-1148-584d-92a2-81fb8f5c7488", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1279210f-d1cb-5e7a-8eec-ba20f2a158ee", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d001431a-2a1d-5e2e-9da5-956b0a871687", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9fc6b5a7-487f-5949-b933-d6d73cc48f83", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b572bea2-dfda-5af3-9707-dc148ade1f23", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:62df4760-a4e0-5ba3-87c2-13a85e47026c", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6c8b84f2-0bcb-5a8b-9cf4-f4dcee66c42d", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8a66e078-9729-5cd1-aa7a-fb3a031c2b3c", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8cd58cc8-4a3f-5f14-914b-b50d97ead43e", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b61fe897-167d-507e-9fc7-135b0507047c", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:db8932cd-06c1-55dd-87d2-6777baacc006", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4cdc4905-033e-5eed-acb4-bc2ec9a63d83", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6215c11d-aeea-5a5b-b301-b3065bebf417", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e16a2d63-ee35-5769-af92-462e1d13b0ff", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:065cfda0-78cb-5aa7-8853-554b459c176e", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2fb7b7bc-79cd-5174-9b76-97596b478148", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:40f39217-065f-5bac-88bc-e883d390dc1b", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9d4c72d3-4b91-57d2-aaad-5fc460c142de", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:dc1ddd2a-6fc4-51d1-8e61-6df0746624b6", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c212a3ef-546a-547e-af43-30a90868e548", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7c3bcec8-7c07-58e0-8da4-d92bb3460e0b", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1e853a8f-2c81-5283-a1a4-dda9d3bed011", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.2.13.RELEASE-tuxcare.4 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.13.RELEASE-tuxcare.4" } ] }