{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f5c14982-c36e-5e08-9677-56a0886e7f13", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-instrument", "purl": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6", "version": "6.0.11-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-instrument", "purl": "pkg:maven/org.springframework/spring-instrument@6.0.11", "type": "library", "group": "org.springframework", "version": "6.0.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:5191a1d4-1c28-5c99-ba8e-ea3ef803b647", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:1b4253bb-9b83-5652-b203-aa7fcdbf5e89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d6b5bf6c-384b-5a55-a6b8-cf54ed6e308a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:eaa94e02-2abc-5c13-be8a-5f1a0170f3a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f998ebca-02b2-56a6-9157-41db32ae15f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ea274d44-3e91-544d-948f-7d71aca7929c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:414ba1e3-a200-5969-8d4b-b6fa6e58e498", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:1ade379a-2f06-549c-9162-33c021237a20", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:9870040c-3361-551b-866e-66aa73b00169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:43848c6d-19ce-52be-ac38-d826f697aae9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:e63f4b06-dc92-593a-87bb-8abfdc886563", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:8640a7d5-4798-5d71-89e9-5db2dfc6f666", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:916dbcd9-1a5b-5992-b17c-45f06eaf63b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:537b6038-b519-5642-98e1-74412a2fafdf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:e7d4c457-ed39-5e9d-b3fd-887211827358", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:439aff2a-86ca-529e-965b-794ac2b05f45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:2dca2c8a-7586-5629-8e85-73ce673dbf39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:70c6a0d0-5308-5311-bf26-1c1076a9c5a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:655fcb05-14a6-59ec-9a70-994bc8bf3448", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:57522127-d619-5090-b243-db3a950fe2fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d0ee7991-8213-5694-8e43-5c747a9ff4f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:364597ad-0f2a-56e8-b07f-fd4149f3884a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:9f6433fe-47ec-5e04-a284-01dc566156dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:1592d7f9-7fc2-5ab5-ad90-deedb5892230", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:e4543be1-4b71-5b80-902a-0a3b55df4da7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:197ff6ad-7447-5760-bc2d-5384db89860e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:cb5bcebc-2664-5677-9f27-60d25b82c1e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:35caf2bc-c0bf-53cf-af9a-b92f9074f668", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:2bfafb46-391d-5f1c-b455-d387fd1f3991", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a06ba0de-4c24-592a-8292-948cc0c78688", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:551b2ad4-1172-54cc-93f2-88a95e6e40bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:92404f82-36f1-5feb-ae58-339141049855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:aca5d586-41ce-5f54-9afe-7e680e66f7d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:84475fa5-a067-5c99-b3a8-a1fdff3116e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:8cf11e52-ed3e-5c87-a6dc-527b6f01f8fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:7bf2bb47-de47-5300-8099-dea1da9b27bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:bd886646-8ad6-5b5e-a8e3-852223824807", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:1b5aaa63-367b-57b9-b2c9-4e41f3d59a6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:c6a0606f-3044-5cf0-8516-a1fef42343f0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.11-tuxcare.6 of org.springframework:spring-instrument. Spring Framework 6.0.11 is not affected by CVE-2026-47890. The vulnerable SSE (Server-Sent Events) view fragment rendering feature was introduced in version 6.2.0-M7, which postdates the target version 6.0.11. The Fragment class and related SSE fragment escaping code do not exist in this version, making the vulnerability impossible to manifest.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:8915ebd6-6697-5e78-8c47-bb2295b455ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:cffd732b-ed91-5efc-bcf6-284f02c8e0ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a4de96ad-f03c-5525-b508-65d35c40dc54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:3788d214-76b4-545c-b720-95ed25c69e76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a18a4d62-a54d-57af-8558-b4371a7e144b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ae683303-89fe-538c-928b-dad776d153c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:e3d9d6f5-e9a5-5973-9a38-96235531ee50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:598842cf-25b1-5cec-af65-6ad080251373", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:df1dd8a9-dae4-51d7-a0a9-5f399b57de0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-instrument." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.11-tuxcare.6" } ] }