{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2d27877a-2bae-5871-9ad8-18a09d1e516c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-instrument", "purl": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1", "version": "5.3.33-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:85d388d9-5703-553f-b111-225a92988098", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.33-tuxcare.1 of org.springframework:spring-instrument and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:4ba7d2d5-13fc-5488-97c9-e7e77a8aca54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:508c4a8c-68b8-5319-b579-94bfa9487d54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:d0c99540-524e-5157-b605-d23b10604894", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:145acb18-3fca-54de-9da1-452af849031e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:1ee9dd9a-bcda-5ecf-abee-c4861f69c59e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:5d37aedc-68e6-5bcf-a497-b04bee51b177", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:3d606f39-3dbe-56c8-af7c-8dfcdb0a9efb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:ebdf5335-db17-5cd2-b800-271575c3b1b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:9ca773cb-328b-58af-8477-042412c02c3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:f25f976c-1ddc-5618-aaf0-2e0b42ec56e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:a8b060e0-b328-5864-97e8-c1516dcfdd5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:c5b5fc19-9108-5342-8622-2438b4f162d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:274b5e77-c2e2-5809-8ba8-5633424158ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:f35ec785-dcfe-56a8-bb2f-e80370a85e25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:431eefcd-4b6a-5670-9bf9-5e2c43af8f40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:92253159-eaee-58eb-8f9a-173c690716cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:943168f9-65cb-5000-8cf0-b1e2a437eed0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:5815c500-be6f-5c14-87f6-90eb1284df8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:00b7c047-4218-54a2-bbae-1f5a6952b1c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:295b8cb3-c695-5571-b879-f3aeb4772cbf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:20095e47-7a10-581f-8eb9-93b7497e04c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:752d2036-051b-5d9c-b589-cc90b71513d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:269f717b-10d1-51f2-8a50-43ed11d6fdf5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:07d903b2-bbf7-555d-b718-a84bc160bab5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:11ad885c-273d-5649-b662-31e5d69f96f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:6e81fe71-3bdd-5b20-a5a9-30dbb1a94336", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:ccb52ce3-9b61-596d-9182-861978d19e8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:3369265a-029b-5878-986a-8704e89f49be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:97bb4dd3-7ccb-5a11-983f-38828fec9249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:2194f180-dc29-5dec-9e86-9ed60431a342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:14acad61-b990-5fc3-a855-49372b35f5a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:9aa7767e-a247-5108-969c-b791edbd1678", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:188515a4-fa2f-5c9d-8ab6-efebaf81f278", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:7111fa91-62a9-5a73-aef9-3730b8c74f90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:942e5ad4-d4b7-57d9-ac7d-5b5ca8ebb92a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:694576fd-2801-5f17-ba03-201cf91d8c6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:ef4d6d09-7003-557e-be39-750ec43f6f93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:75a33136-0f9b-504d-9a51-b1e1cd4714cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:03208798-d140-57df-9414-e5f592d99bdf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:4612190d-f14c-50e4-acca-2c3c958203b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:d8eab278-6db2-5907-85f1-e939a2a555c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:0101f40f-8518-50ce-a30f-a44ce0e75261", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:aeb858d7-3ec9-56fc-9c0f-b737c395273b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:662e7e19-e58b-547e-93c0-00a18149f357", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:911a4f7e-4840-59b0-89b2-aedda38c96b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:eb485aef-e1a4-5035-9af0-9f2eccdb72aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:5ab6ea5a-afe4-58c8-982e-99a0e8564631", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-instrument." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.3.33-tuxcare.1" } ] }