{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6203d684-6bca-5875-b884-592fb7cae63d", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8", "type": "library", "group": "org.springframework", "name": "spring-instrument", "version": "4.3.30.RELEASE-tuxcare.8", "purl": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:5c6a9ccb-b170-59d1-81d0-0b2874e229b5", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d565f446-f071-506d-a95c-25262a5ed631", "id": "CVE-2020-5397", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:e086b9d9-f391-51d7-b3bd-7c975cdb47cf", "id": "CVE-2020-5421", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument. Version 4.3.30.RELEASE is not affected by CVE-2020-5421: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 6327c60912cd80120040c8c16c3731d8bf6c19f6\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:0a891065-ed8f-50e6-9721-e406dc4f8961", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:6e8af1a0-0073-55ce-8900-b074478931a6", "id": "CVE-2021-22096", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a0d81ca8-7503-5db1-b98f-4f8532c9bce2", "id": "CVE-2021-22118", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument. Version 4.3.30.RELEASE is not vulnerable. Summary: Target repository is Spring Framework 4.3.30.RELEASE-tuxcare.2, which predates the introduction of WebFlux. The vulnerable code (reactive multipart handling with predictable temp directories) does not exist in this version. CVE-2021-22118 specifically affects WebFlux applications in Spring Framework 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. WebFlux was introduced in Spring Framework 5.0, and the vulnerable multipart han [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:fb2d6898-3738-5d28-8723-9701bb9a7811", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:515041ac-5519-5fa9-9f3f-4e40ca8729bb", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1c707cb6-8dca-5b7b-ab9b-0302cee97597", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a470c26e-99da-570f-820f-ef86d9ec22a5", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:8f6acfe5-5eb9-5f85-a8c0-e635903617e2", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:f3923add-8fec-59ac-b72c-c14cfc73d8b8", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:b83d8f1d-8111-536f-8877-db328550f18d", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:2aa305de-9739-59a5-8254-067cb1b02f8d", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c92f8879-fa7b-56ef-b33d-00dd723dbead", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3191ac7b-9b10-5be4-85cd-6e8247001d0d", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:0d02be12-3c3b-5229-8c2c-7b2fb5e9898a", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1921401f-d31d-5cd1-a9f4-858e8e2d1ce1", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9067ecaf-297e-58d8-9def-14818e5639d2", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:7f3628d1-2145-5824-b1b6-50b58e85ec8c", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9556e23b-a85d-5459-be1c-9f851d9ee37c", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:00e2fbea-b8d3-5eef-a22a-cb14afd47b16", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:af7900f7-7f5f-5b68-8643-f5b7a46e2418", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:36275e9f-09af-5629-b1c7-82c52f36a343", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:926b0007-e7cd-5a84-a32d-10533850db8b", "id": "CVE-2026-22735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22735 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:2a869e0c-e92c-5183-af6f-5d6de0c9877e", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:4633cf9a-3443-5424-b991-831f75f49cc6", "id": "CVE-2026-22740", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 4.3.30.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 4.x is not in the affected range." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:f5302eb3-384c-5341-a749-f4c6a826b7f0", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:758e1dd7-a87d-594a-98cd-faff534e73f1", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:6c3e82d2-76d9-5a87-b69a-c4942f6813c5", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:5083958c-5d99-5f63-bf97-779b2df0ed5a", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:e9ae65d7-e4ab-51e1-8ba6-05585453cf94", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:87363fb9-0827-5d74-a0a2-50c8fec450e6", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:f74ea987-c7be-551a-9d77-22b0d8ed2236", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:f81c10ec-45c3-5767-9a77-2971a684eae9", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:b30f4fdc-7981-55c1-8526-be834a4f9de4", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:eaa42b7e-a914-56c3-962f-9b9f0bac8cc8", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:76b64211-b600-588b-983b-df2afcae8340", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ea92ce1b-e331-54d2-84b9-470bbb1f9dad", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c4cf0db1-fb02-5fe1-a499-c8035b04a84f", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3b673e91-c0b7-5c46-a6fa-35c7fba12d15", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ebe7361f-3e5d-5630-8e18-f7dd41fda61d", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument. not_affected \u2014 Spring Framework 4.3.30 is not affected by CVE-2026-41853. This version predates Spring WebFlux (introduced in 5.0) and lacks the vulnerable component DefaultServerWebExchange.java. The vulnerability mechanism - Spring Framework's message reader selection based on wildcard Content-Type headers - does not exist in this servlet-based Spring MVC architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:f8b1e8ff-df21-5352-8a8e-0f295afacc79", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:5fba9f7d-5517-5343-a59c-8ab18bf3bbb9", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:325fc7cf-622b-5a5d-970f-93dff4a96205", "id": "CVE-2026-47884", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:494f5389-7f4e-593a-9eec-3438f82f5347", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:bd861c83-4c57-54a3-9077-9394dc914160", "id": "CVE-2026-47887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:8b13f5ed-a859-593d-b0e1-30c4f6a85940", "id": "CVE-2026-59280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:25ec09aa-1868-5cb4-ad92-68b37e0d619f", "id": "CVE-2026-59281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:191ab2f3-1faa-5ca7-a47e-83a469e2ae3c", "id": "CVE-2026-59282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:8c940e56-1c96-5eb4-8ecd-8d4f08d7cd81", "id": "CVE-2026-59283", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9cfe1870-657e-5305-b6ad-d52339833b47", "id": "CVE-2026-59314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 4.3.30.RELEASE-tuxcare.8 of org.springframework:spring-instrument." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument@4.3.30.RELEASE-tuxcare.8" } ] }