{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cfb3d050-ef3b-52e6-ae0a-e03bba8d1b31", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-instrument-tomcat", "purl": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1", "version": "4.3.27.RELEASE-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:92bbb960-8200-5261-8f64-d6295c982cb5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ec8a3eaf-ba34-5349-b87c-34a3bb5065e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e79fb7c2-ab99-57af-99a8-3b85f24a4380", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:19796ce0-2df6-52b3-8c8d-6fac38e87e27", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat. Spring Framework 4.3.27.RELEASE is not affected by CVE-2021-22118. The vulnerability exists in WebFlux's reactive multipart handlers (SynchronossPartHttpMessageReader, DefaultPartHttpMessageReader) that use fixed predictable temp directories. Version 4.3.27 predates WebFlux (introduced in Spring 5.0) and uses servlet-based multipart handling via Apache Commons FileUpload with servlet-container-managed directories and random temp file names, eliminating the attack vector.", "justification": "code_not_present" } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3c5d2fc9-211c-53f5-8144-2ecf4e3d4cb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0d33c282-296d-56d2-becb-c3d9ba25aa0c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:763d4eee-cf8a-5e25-bbe2-e0ba89152c9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:be0c9843-4d23-5700-b6ed-c0a31523902c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5ea24a51-61d7-5827-a52d-eef83da4158e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2b34b4ee-5634-5a10-8a2d-35355dfc0e05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d390ede1-c9b1-51ce-99e3-a7e9a043e980", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a507821c-278f-5b66-b906-605fae3fa12e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ff9893f8-7497-54aa-8b88-7fec68203d3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ff58cafb-a434-5153-b0aa-0947c39b20fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e5bb65fe-1628-5a09-ba9c-1e50bed8801b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:688893db-f544-5b7b-9827-a2f75b9c52c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4d18f6ef-5dbf-5a31-b702-bcf35d509410", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5d243caf-89d4-51b8-821d-787962ae3aa5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat. not_affected \u2014 CVE-2024-38820 describes a locale-dependent toLowerCase() vulnerability in DataBinder's disallowedFields pattern matching, introduced by the fix for CVE-2022-22968. Spring Framework 4.3.27.RELEASE is NOT affected because CVE-2022-22968 was never applied to this version. The DataBinder code uses case-SENSITIVE matching without any toLowerCase() calls, so the vulnerable pattern described in the C...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ac2f6fb7-5375-56a8-b0e0-2ea87489e2d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d25cad97-3997-5c80-ad3a-5a49f7abb5a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b7612591-433f-52fb-8633-a3dac2da7817", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c0998722-79ee-5376-9120-1abf5f380bca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:004ceab0-3dfe-51ad-9791-a8638d152a71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c4146f50-8ce0-5933-960a-1c7e09191323", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9a5b0cfc-6ddc-527c-a88a-c75c7ab38151", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat. not_affected \u2014 Spring Framework 4.3.27.RELEASE is not affected by CVE-2026-22740. The vulnerability is specific to WebFlux reactive multipart handling components (PartGenerator, MultipartHttpMessageReader) that were introduced in Spring Framework 5.0. Version 4.3.27.RELEASE predates WebFlux entirely and uses traditional servlet-based multipart handling with a different cleanup mechanism (finally block in Disp...", "justification": "code_not_present" } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3dbf0a76-9866-566b-8f8d-f76f0dcc0151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e1c0019c-dcec-5e54-8864-ca12160af326", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:afad8e84-2df9-53fc-8bcc-2bb581aafcf9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:431b92b9-4046-5712-b427-103fefafe69d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:eed0b903-630a-5b42-af04-3b556280ad34", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:66d358b7-c028-523f-a9bc-74465c9f3ac5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c4be3312-53aa-5657-8a7a-943bc8d6912a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:59f2c4ec-95a2-596e-82de-efb9da7413d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6adbd1fd-8364-5c1b-a067-4c8edbaf2c22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6440ebcb-75de-5e90-a615-a1d8dd0bab57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7acaf1ef-7e21-52ac-9d81-f5de0041b163", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3a8ae64e-2812-5d31-aa16-ca0a9930224b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3c14b15e-0cd9-56cc-9159-62a11f78576e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:60658549-806c-5a47-b9d4-0c62251d141f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:94b104cf-1971-517b-8bdc-1158cf7c15f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6dbd5104-f1f4-5a0f-91ae-f13bd34cede8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:718f1077-4abc-5883-a54b-d9f35200dc5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6b90689c-0aa9-5994-a2d2-aedfe1aa9f6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:af51b2f3-de72-5416-8de3-af05e2096419", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5127e937-3541-53fc-8d05-450ee9f42c75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4c1c8f44-0841-5d35-90e2-08cb19131c11", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:eebf44c4-e318-5ee3-b7b0-866f49236ab3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c8136a82-be72-5c31-ac90-abc19b21c00e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d1b1d49d-1507-5ad5-8280-1bd047e06737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1c3c512b-0003-513a-adc8-aefcb06e272b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-instrument-tomcat." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument-tomcat@4.3.27.RELEASE-tuxcare.1" } ] }