{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:868b6f82-ecbb-5935-b9eb-da01e00f5ece", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-instrument", "purl": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10", "version": "5.3.25-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:b95b291c-e897-5bdc-8509-2b4e48cda513", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.25-tuxcare.10 of org.springframework:spring-instrument and will not be fixed. CVE-2016-1000027 is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:0af0f51f-9cb0-5c1b-a44d-214b121fbde2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20860 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:20230bcd-5995-502c-811e-aba4f384cd27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:a37865e3-dff0-5d7b-846b-3d3730c8a97f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:d66c9795-c38f-50d8-b8c8-4d00178d7b9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:3c0d075a-f70a-51f0-8cf2-16021d59e510", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:e8190cca-2dca-5052-86a1-57e4df23b6ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:a0466795-3fac-502c-8cfd-4d2e89d332fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:aa99fb22-b0cf-5c76-acfe-9e3563d390b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:8d791dc4-535f-5f0f-9321-a77a8d43c766", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:d4514593-6173-5af4-bcb9-59340a88a9a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:c97b2393-5e31-53c0-881a-1d4e491ae078", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:486246df-bd1c-5ce7-82c6-7b65ae61223d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:e875edc6-c220-52b3-a042-6f2552725855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:0014fd0a-04bd-5002-a2d2-2f0eec89a883", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:8585c8cb-f634-5723-ac74-285385119268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:972685e0-4b3d-5584-8d07-7b9e083bc724", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:343b73ef-a856-5292-a1f3-c8659622db7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:1cb9fdd2-3097-5b5a-bc3a-8bd58f2fa104", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:05d818da-693d-5c32-8fb4-46565e1a475f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:8a5a29f8-be68-5ecc-9a9c-416958329189", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:1860ef16-8920-5b0b-a742-603a17085c62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:9fc1b0de-0744-51a0-8e25-f1ec45c13ab3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:75ba5144-ce7c-51f9-a5c9-78dc107fee90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:28b43198-405e-5cdc-bd3a-d4cce36761d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:0e06e11c-8b37-5648-a381-7bca0f677fc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:77bd1b6c-787a-500a-a8d6-f9da1ef1a51c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:ffd9d1b3-885e-5c13-af5c-f0a1f3c42623", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:31fd9b60-8510-5d66-bfc8-b87018f39bdb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:504b44f3-0d7e-5169-877a-e4c2d1950262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:0b0520d1-f26f-50cb-ad5a-78c2af7928d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:60851297-7011-526d-a77c-e50667a784f9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.25-tuxcare.10 of org.springframework:spring-instrument. All 1 patch commits already exist in target branch", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:55001f19-4b4e-59f7-ae42-e93b9ba8c80d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:5f74feca-fd77-569b-a412-1130d5ef4d35", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:f91d9bf0-ad89-55fd-bfa9-953fcb917523", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:bf38b904-918f-528b-891c-a174cdbb1088", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:51470f7e-5d1a-5bc7-8d24-c8bef8b5b48b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:aa7a983b-6d2b-5b6c-9be4-7a69960edb59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:2eca633f-570d-5acd-8f49-e32036e5ee31", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:6e5fe687-0eaf-590f-9d49-da2beda3b57a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:1a6c5a99-77c6-5802-9d43-a58a5ed6f768", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:903dd289-56fa-5f78-950b-bc78f9d3f594", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:5f9cb861-976e-5aba-8135-ba71e80bc04c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:645be6a5-1751-5a58-bda2-ca4944690bdf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:89dbc24a-dcaf-59e8-bef5-27c60a93b0d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:fb85c569-5eb2-543f-a4c2-868ee4ef13da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:2285fc0f-2615-54b7-a806-1d2798f748fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:99eca38c-1ce7-5f4b-9582-364a40cdb157", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:1a658019-cd7a-5535-af96-f963f12a19f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:f2bf4878-08c5-51e7-ad57-d6d7ffd5751d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:44535e9e-1805-5dc7-b5f9-02abb25f291e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:0fafa3e1-16e3-501f-9500-2f56858998af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ], "bom-ref": "urn:uuid:6d819eb5-885c-5e59-88e1-4057b04dca65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-instrument." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.25-tuxcare.10" } ] }