{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:841d16dc-a1e6-5b73-bbe8-64b120b7259a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-instrument", "purl": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10", "version": "6.0.16-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-instrument", "purl": "pkg:maven/org.springframework/spring-instrument@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:bf8ea138-ba4b-59ce-a4c5-2fe3c1fa63c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1c330850-187d-57c3-a7ce-43ceca530390", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3385a84d-72ec-537c-b193-b16cd104f3d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2b6b14cd-54af-50bc-820d-d4c7192d2a02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:5805539e-8866-5dfb-a363-eb71c89e88e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:70668420-17d0-5aec-81c4-850e64b4c512", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f31407f9-0ce8-5772-87fe-3930a6a11b4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d5127145-a5e2-5f3c-bd5c-ea09f156d650", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6630e0e2-ccc2-5de9-bcbb-58159e942ed6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:7985fe25-34c4-5cc4-9f4f-27cd4302a539", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ca4d121e-f169-57e8-ac60-cb9d3b837120", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e80c1a45-5365-593b-8d8c-9b3cf7fa7c7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c0531213-e725-5706-8f3b-f34eee44a265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:93e82ba9-7bf1-529c-bc38-a856ac5d9c92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3b67d99b-37ae-5c25-8b5a-2d52296ee999", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:8f30802c-b604-5dde-9567-f89192118e6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1f89e4a3-e7e3-507a-8eb1-d8fb2e0be3a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b0a3e09d-61d4-5f37-8d3c-0f378856a909", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:90216f4c-4d27-59b8-a457-ca295ade5555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:80741c7e-b9bc-5e65-b274-8179002c2316", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:0364daf3-e14e-5d61-b0bc-323a766dd9c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6fa58c6c-96be-5144-90d3-5bf4b072ce82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:a6536da6-23cf-577d-9564-ae283e4eecec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2a666a26-9f3b-59d3-a78f-531320050d3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1d75e8cb-c136-5fa7-aa80-7ab72e65f7a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:35d4f116-e2f8-5b99-ad5d-fbb563ec9491", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:cf87c3a3-e6f5-55b4-a284-4620975e50b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2888bd52-3e3c-5865-92d6-a24277e5a3be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:43fbc05a-41b1-58ab-a93f-f384063801f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2c0f4c36-8ac1-516a-bf42-748d1f7089e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:0019123f-b576-564a-af31-bb764b309e98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6aa44764-ce70-5684-9d1a-95b75923bdf8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:5f34f8bf-10e6-5aef-b93d-af7930614ece", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3fb2358b-1f70-5bba-a77e-95f0eb399142", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:198ede42-b8ac-5b68-819f-7ba2564ea163", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b8f1642b-0dcc-5c2d-97e9-9db1f350ef47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3e3b4148-8306-50de-958f-f443afef9f0d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:8c532dee-e0e3-5e81-9edf-b8d58d56829c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-instrument. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:cfa4f86e-5558-5105-a2e3-c6185bcceb3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6b2f9351-ef86-5faf-8a39-fe4f0f4c6112", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:00330825-c615-59f7-bc71-7094dfaa85d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:81a51bd4-8675-50a7-95e9-bae3049e2e92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:061f188f-8d15-5125-b154-56feffacbccb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c248ae65-7833-5902-a414-009f081cf074", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:10dfff9b-5166-571f-96c9-179bb990f3b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:96f1a3ec-690b-5fbe-9c8c-54b00302a866", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c6062542-a706-5d59-967c-c0707861a119", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-instrument." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.16-tuxcare.10" } ] }