{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ecf59fae-c2e5-5385-b711-d02c6083223f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-instrument", "purl": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11", "version": "6.0.23-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-instrument", "purl": "pkg:maven/org.springframework/spring-instrument@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:58f10450-a144-5cf7-bec0-af3c85855493", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:cd9ad22d-2925-5b3d-918a-84dc823f0988", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:46052ffd-c51b-5286-9ebb-1e9116418c3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:d3932399-6993-508b-bfa5-3d1016140c9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:e798dc20-b950-5b44-92cd-84fac025fcab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:120cd23d-b24d-5c79-844e-2ef4ef682f5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:db04e7af-f062-5054-81f5-c13e79dd1646", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:6534e0dd-d8c1-560f-8366-4de00240ce25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:5bdfd6d6-6833-56ee-ab13-f6252335cfce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:d46033b2-bd00-54a7-8332-96bd9967618b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:1c81c471-b335-55ab-94ab-89b31e760a1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:5087dfb2-92f6-5dc0-90f3-4759da87a501", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:3eb05d2b-d9cd-50a5-b123-f73c908cd61e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:e94689d8-37e6-5b43-8669-5e6e212562a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:a2710e79-7682-5777-a12e-6ed92d7227e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:8bed1175-0f34-530d-b6d8-f0d2592a21de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:f522548a-ea66-5ea9-b9a7-6fca3e474311", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:4f431c39-7761-5481-b0ee-94e57bb51bd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:9c15bc85-2be1-5860-8222-1d83f00fc2f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:6258d7da-8b1a-5ecd-bc55-372d3e86f2fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:4c09c021-1370-5b11-99f4-b93141a45db5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:26cb9365-c9e1-5b69-a36d-dcc8b89ae8be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:91e8cef3-8c82-5435-a529-dc266cb6e6f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:de065930-2692-526c-bfeb-42cc26b8bb7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:109325fa-7b02-538e-8813-0e0588382cd8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:4cb04552-075f-5d22-bbf2-dc2635465304", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:8df3ac3a-5e16-5571-ae35-959619bd481c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:1c9cd2ed-f119-54f2-960e-afcea9af916e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:98a5ee51-f347-5019-b344-783a9e694de8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:c52f6649-a503-54a3-8566-b61c93f9b24e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:db118ca4-1e92-5bea-9c55-8de3f549515d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:901283b3-857b-5f07-bde3-1f6a035df83c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:3967b984-e6ec-54f3-bb5e-52126b8954f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:86fb5a5c-499c-5374-b61c-8ed9bc79a36b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-instrument. Spring Framework 6.0.23 is not affected by CVE-2026-47890. The vulnerability is specific to the Fragment rendering feature for Server-Sent Events, which was introduced in Spring Framework 6.2.0 (commit 622c1b9e8c, August 2024). This feature does not exist in version 6.0.23, therefore the vulnerable code pattern cannot be present.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:02752a16-3d07-50f6-9a55-f9eb83306599", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:d35aadf9-5d5f-551b-8501-0380e6d1713c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:bf291c14-7a6d-5032-839a-8501f5b29dd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:3a76bda1-e3cd-58d6-9ca8-28e2a3f10f49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:216e8a50-21ff-5485-a113-9900f90d2174", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:bf6d084e-ec88-5474-8788-40c0ae78f67e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:495e531d-bb68-5816-ac81-1848859b1222", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:65c9e122-c001-5732-9a6d-6bb0db95fec7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:7f9e50e9-a951-5cde-a1a3-b997ede0bff3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-instrument." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.11" } ] }