{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b29000bf-2f29-5d91-ad57-f24baa6a98dc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-messaging", "purl": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2", "version": "5.1.6.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-messaging", "purl": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE", "type": "library", "group": "org.springframework.security", "version": "5.1.6.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:86daa9d4-9dad-5fc1-ab76-052241602a45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4c9bdd49-2d43-55ef-a843-4f2d562a5c07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0f69040a-0335-56c0-99e5-8bb3796d8d4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e7bbd5e5-ec78-5b25-ace8-83cd7fe6d090", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2a30c42c-6fb7-53e7-8f1c-edf162b838e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:23891f08-861c-5ee4-a04f-68e5af856b29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4e1bc2b7-324a-545a-9e5c-c585041b646f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:14607e1f-2145-5358-93f6-981c5cd999a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:23e654bd-5c33-55a1-815d-3d13cbf6f7ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:95584d62-3080-5cb7-b7f3-58ca799b0d8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d994fc04-d5c5-5370-ab6b-c45678ff8b14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ff3e3695-5b1e-5e30-839c-2f6b8e44ca32", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6a955c5d-1292-5ca1-bbd9-9191d09c5b55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a1160737-2ce5-55e6-b14a-50e03b21483e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:de930d75-3916-5018-a520-d6d927106927", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cadd5864-1dbb-5dd6-aa82-523dbebd1c27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bcf4ec44-1b63-5c57-aa1f-7235eb456a4e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:87cc3942-cdbd-5ac8-a223-00ae6522c49f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7d0fe85d-a17b-52b9-b554-3bdf6c815264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:96ed5ce8-0f65-5134-aa94-f60d052ebb9c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3c88f918-c45a-55ce-a45d-fc3b73f24475", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d3b7f362-af38-5214-b1b6-099c7b008f63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c60b3d39-309a-5815-b6e8-3a181d39e1a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fdca4119-992b-57e1-8063-992b2973e156", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:990f042c-a96e-546d-8a78-d507cf80f74d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:07d1c0c4-3282-5fc4-8df4-d421ccca2e44", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging. not_affected \u2014 Spring Security 5.1.6.RELEASE does not contain the vulnerable code. CVE-2025-22223 specifically affects applications using @EnableMethodSecurity (introduced in Spring Security 5.6+), which resolves method security annotations via UniqueSecurityAnnotationScanner. Version 5.1.6 uses the older @EnableGlobalMethodSecurity API with PrePostAnnotationSecurityMetadataSource, a completely different impl...", "justification": "code_not_present" } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d4c98fea-1fc1-565b-813e-d2a11429e628", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging. not_affected \u2014 The target spring-security 5.1.6.RELEASE is NOT affected by CVE-2025-22234. This CVE addresses a timing attack vulnerability that was inadvertently introduced by the CVE-2025-22228 fix. However, 5.1.6.RELEASE never received the CVE-2025-22228 backport, so the vulnerable code pattern (unconditional 72-byte password length check in BCrypt.hashpw that breaks DaoAuthenticationProvider's timing atta...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:06f975bc-e9f7-5c86-8fea-40fb5356a66a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.1.6.RELEASE does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2ca2be68-52eb-5196-a839-ce9dcc754a7a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.1.6.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:148a0311-a64f-5654-b563-d9b2f10ea054", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ffd7398d-8916-569c-a7e8-332db757c406", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) was introduced in Spring Security 6.4.0-M4 (July 2024), long after the 5.1.6 release. The target version does not contain the vulnerable code, cannot process one-time token authentication requests, and lacks the authen...", "justification": "code_not_present" } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:32998f8c-6c77-5d5e-a84c-ce7b24b90528", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:427a69cf-6539-5887-8aeb-094cd72fec17", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-messaging. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-59277. The vulnerable component InetAddressMatchers (with matchInternal() and matchExternal() methods) does not exist in this version. The class was introduced in later versions of Spring Security. Version 5.1.6 only contains IpAddressMatcher, a CIDR-based subnet matcher without internal/external IP classification capabilities,...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.1.6.RELEASE-tuxcare.2" } ] }