{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3a92cf26-ca33-5544-b27a-e8df203f4f99", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-instrument", "purl": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6", "version": "6.1.15-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-instrument", "purl": "pkg:maven/org.springframework/spring-instrument@6.1.15", "type": "library", "group": "org.springframework", "version": "6.1.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b2b14c39-9903-502c-ad60-b2720778e297", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e8b368ab-d8e9-5c6c-92e5-c6e208eddf1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:d0bf56c5-f930-5bcf-9698-90dc907051cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:2f66039b-9a57-5782-a0f7-6b9b1aed87dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:8227e653-fac9-5c87-91e9-ad275b8bb0d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b6c733ee-b4c2-5e29-ac45-b2351d12984d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:39ce9168-20af-5cf2-b930-70473f4158b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:73efad5e-be48-52f6-8166-3a2fc07e739e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:191de638-ef73-5c29-9eae-5efdd4243a1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:8ddce4e8-394c-5f44-8795-365d21bd08ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:0fafe4b5-a5f7-5d04-8b78-bf20baa0ed43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:893ef700-59e9-5856-8d6e-adee47844163", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:302a8a7b-b1e5-56b8-b27b-b673ee23ef14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b056d74c-c735-552f-a266-6ddd60149b83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:14b3cf4e-65ce-5106-a37e-74711dbf4f1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:7f0b622d-fda7-55d5-b068-1cd1e47767d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:d65d44a7-0d34-5301-808d-9941968aeac5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:8d63b71d-29f8-5705-977a-a4328a02a66c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:fcc2b071-277c-590f-945c-2d154a7b59fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c7e704f2-a648-5772-ab45-65101391f840", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:80b90575-d6b2-5970-b152-7baa4ab9794f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:8d93dce6-967b-5466-bf7f-fc2f18b63005", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:cc9c0733-84c4-5fed-8dec-ff9e3c4a46e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:35f98678-6532-5342-b8a2-f0ab3329e051", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:cb01a29f-a670-5ae5-b214-5aaa08df03fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c3622e5f-2fa9-566c-8b96-8f8c02e567a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:17616448-1685-5310-a500-af88f014a9d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:0509c660-a7e9-537c-aea1-9326a47c4612", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:09b079c2-744e-5746-81ec-f01f3a70e706", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e1abba6b-8594-5c5c-ba68-b75c7d9165cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:24fd5f28-cb7f-570c-bde3-63b1e286b5f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:7d9fe2d5-a515-50e9-8416-bc261bf121db", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-instrument. Spring Framework 6.1.15 is not affected by CVE-2026-47890 (SSE view fragment stream corruption). The vulnerability exists only in versions 6.2.0+ where the Fragment rendering feature was introduced. Version 6.1.15 lacks the entire Fragment/FragmentsRendering API and associated SSE view rendering code, making it impossible for the vulnerable code path to exist. Git history confirms Fragment support was added between v6.1.15 and v6.2.0.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e379b2c7-84c2-5b8f-ae26-651a60a357d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e7ffb9ac-c06a-577e-8387-0eb866507477", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:081ff024-1f28-5e5d-a9ee-ea06ac72ae09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:3673e955-68ba-522e-add5-edfd407f41ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:460e1a2d-85d1-5db8-a5d4-cf190655eda8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e5725f38-36dd-54ff-870f-e67deacf4101", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:14381e7c-c092-528b-bf50-617c7afb8e4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:973132c4-5525-52c5-b7af-8f0159ce32a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:6dd47ddc-a05e-51bb-a845-908f91e74071", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-instrument." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument@6.1.15-tuxcare.6" } ] }