{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5485e4e0-ef09-5e53-b023-76b18dc7ce2d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-instrument", "purl": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11", "version": "5.3.30-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f6c70a94-086c-5d1e-ab3a-7de3ffeb5b27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.11 of org.springframework:spring-instrument and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:53a2742a-4980-5682-a343-35f27364aa29", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:0d2bf8a6-b0cf-5d35-b49e-5c3b90427431", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:c04290fe-d805-5f9d-a7d1-177706acb2fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:8d3234a0-ba02-5b16-b4be-6fb889bcf8af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1f2498ea-8a4d-5393-9baa-2054dbf97028", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:561a1740-6d14-58a4-9a18-c43ec45fbf75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5970418c-5a8d-5c4e-9ef6-5922f36e699f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:788e1ef8-e397-59ec-a84b-fd8a9c0567e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:9fcf6990-2e08-5d41-b6fa-301fa0c75bc9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:9951676a-4594-5523-bbfe-1fb482468bd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f2376e26-e855-55ba-b22c-d4bace1e235f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:fe49769b-ab72-5b43-93d1-944fb794d8e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1e379fc8-7db9-59f2-a74b-f9cc3176d874", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:7e0936fe-1423-5964-acbc-8278b03cb063", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:223e46dd-fddd-5785-ad86-eed843724a26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:24d59c5b-5fdd-576e-b384-77f056214ce2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:e9e825e0-6544-51e7-a9fe-8ba28641325f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f6897389-a9be-5b48-8c93-bb26a00132b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:ef8343ba-2a5a-5734-9c1a-fc2ab2b32b3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5a672e15-e923-52b5-b557-62db81aa474f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:91b4284d-1362-51ce-b39c-f543ee95139b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.30-tuxcare.11 of org.springframework:spring-instrument. already_fixed \u2014 The target repository Spring Framework 5.3.30-tuxcare.3 already contains both fixes for CVE-2026-41840. The identical patches were previously backported by TuxCare as part of CVE-2026-22740 (commits 1a619adbfb and ee9443b0bc, merged May 2026). Both doOnDiscard handlers are present in the current code: PartGenerator.java releases data buffers on discard, and MultipartHttpMessageReader.java delet...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:580bb5a2-85f3-5e82-97f0-1b8c138dda23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:52287c8b-9589-5b36-af76-5ef2da3ebfe8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:d413dee1-a2b4-5fc3-b56d-6ff406eb3b1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:e5e19cf3-5d57-5017-a824-b0a047ec5088", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:2afed80c-31a8-5a42-9944-66502f3979df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5fb3c5d3-d218-5afd-9348-976c8a6b15a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:521cbd01-35b2-58e2-9c69-70a561edf702", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:72e34621-9aed-5c16-86c6-f70656be1504", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:ae0ee044-5721-5a17-a794-871a46340393", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:92fb6347-1af4-59f5-801f-ce7b3449cc51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:cde183f1-0e8b-5f34-8363-402af734fc29", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:2698871a-721a-51db-88bd-63277805972c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:3b4cb7ac-a518-568e-a98f-3d3623b0ba5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:7a8ed034-c88a-5ed3-b0c1-7290566dd104", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:07153285-8c6f-5608-b534-fbb6ecf9c6cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:38e75800-a12a-5efe-9281-b27a0a51854b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:079d8a2d-4c2e-598d-98dc-7dc90c5e50c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:d5734ec5-5042-5137-aace-1c122d9101c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:4447678f-6ad7-5e11-8ad5-e6cb68090f6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:0314bb17-d7ab-5128-827f-fa96b23ec3c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:a6304e70-e5d5-5cae-be56-5a1c2aa02498", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5221bdee-520d-53fe-9edf-9e044d602574", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f240957a-e446-5c9f-816c-1a5ef6548257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:9e6f698b-5316-5d78-b9c8-e62db4272be8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:139c34e3-9d97-5c93-8d08-159600fd2895", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1d416d87-3f76-562e-b4f7-d24dc5e09d40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1577efc2-aba4-540d-8be2-68d77ee6c494", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:d829b4df-fa63-5e4f-9a89-d536ab098542", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-instrument." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.30-tuxcare.11" } ] }