{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a7476592-14d4-5e98-b92a-0b410660642b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-instrument", "purl": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12", "version": "6.0.23-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-instrument", "purl": "pkg:maven/org.springframework/spring-instrument@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:92b6209d-053f-5a27-8237-7d41cd9160a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d22ec2b5-1d02-5672-a770-d9711505e527", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:2a2a75d4-d9df-5bff-bb20-326f19e52eb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:a9db9e85-a360-5c9a-a63c-5c139e2bc7aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:cfb6a283-0ba5-573d-bb2d-5e15114635a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:03a6c520-60cc-5c7c-80b0-8dc6adc144b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:8ac4a0ca-6e43-5126-a4c3-24dd1eee4d04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:5fb19e4d-3692-5bfb-9297-906170e66e47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f03e8315-b557-5e87-9bf3-43a5ead3febe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1c4493df-2f02-5679-bde9-fc837789bf8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:787d07b5-9229-5865-a30c-172a9a131966", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:061927fe-f916-5213-9746-d524580870b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:28d0f109-2388-5000-8971-164ec9e420aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:76a75a72-2025-56a1-b650-c198b201eed9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:3c92c554-c37c-540d-bada-6a8b7e379484", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:956fba7d-c29f-52b0-b739-ac69d27f6bfa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:a0d71a48-bdb0-5a01-89a9-65b0410d1fa7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:029a69e7-744c-5dba-92dd-222ebaf3a34c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:dfee6129-c6e2-5f87-af83-6cf99f8a347d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:2d01fa56-be45-5ead-82d9-100c94796ba5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:da00b8bd-7474-50cb-a57d-bddb59883d27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:8e46cbb2-baa1-5e1e-9ca2-dd940974a923", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d4662b73-6ed0-5a16-9246-fe0c3145e2f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:49d5730c-c3f0-5668-8ca4-f7409741ee37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:da11f28b-50ea-5168-93ad-a163ac25853c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1cd2eaff-b377-5559-be27-31d61c2e9aaa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:569c567d-af1b-5f76-8401-963538c3c2d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1566a79c-2fce-5970-867f-3a484cbca8d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b1db3fba-cacb-58a2-8974-ed01adaab777", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:e51af455-9139-54dc-9885-16335213f405", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ea70c273-bba9-5715-b442-491caf9e8439", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:7f8b9656-9f72-5bcd-8b0b-0bcbf0a0a29c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:774161d9-6bd5-5def-9558-5a47685f480c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:826b7e58-fdc3-5703-8173-8413250d9108", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-instrument. Spring Framework 6.0.23 is not affected by CVE-2026-47890. The vulnerability is specific to the Fragment rendering feature for Server-Sent Events, which was introduced in Spring Framework 6.2.0 (commit 622c1b9e8c, August 2024). This feature does not exist in version 6.0.23, therefore the vulnerable code pattern cannot be present.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:505b0143-e374-5677-a383-9225e1e087af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d94c236d-d0de-5cc7-b881-ab807b94d197", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b2887df4-de8e-523b-b83f-3d8c8ce3c01e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f78aab4b-f6d7-5279-b240-e02533016e8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:a3c3b0cc-73d0-507f-8e8f-0a13ff91452d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:05dff4ba-ef13-5661-9b11-17823a9277bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:5a950ac8-22a3-5138-b316-70e4d16af94d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ce5121fe-91e8-5bd5-b149-39a631591966", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:def52e43-160a-5721-8e21-27abc0a83981", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-instrument." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.0.23-tuxcare.12" } ] }