{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f4547d2f-2090-50c9-b49e-24a62888365b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-messaging", "purl": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1", "version": "5.7.7-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-messaging", "purl": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7", "type": "library", "group": "org.springframework.security", "version": "5.7.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:f10175ae-a148-56af-a861-bb6d13296af5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:c161cc79-ee92-5a9c-846d-96005c384ce9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:7be7d0b7-d044-561c-9585-b9fb066ff975", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:7a54d351-271d-574b-8859-abfd48922aed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:aab9f2d0-b5fb-5d3d-9617-a5006a681419", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:22a507b1-ed2e-588b-a765-70977bdcaab8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:972d18c5-b74a-5c09-ae34-d9fb9ff67490", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:ba1ffcf7-2b5d-52f8-806f-6f0d3850877c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:1a96fd3d-63ab-5468-8fcb-c17438dd65a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:eacb2e10-28fc-517a-a516-06140eccd42f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:d6624bdf-de57-54b9-8824-ba24dec2083e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:bd9bc8a6-0d8c-596e-a595-bb851bd31ee1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:9dce2ea7-edfa-5bf3-859a-49896134ab0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:c3a1f9d1-dc25-5464-8614-1f6b7040fc3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:e0ebaff3-92d4-5ed6-8c02-f01513e8ecda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:36f13e6c-8b14-5cc8-9eb5-f33701c72484", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:6185556d-1447-54d3-a01f-e1cee8bd98d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:6d4928a4-af22-53c4-b36a-9a3acfae8893", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:0c91d66f-0b5d-50f4-966d-a5b8ceaca3f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:d728f3ae-0020-5034-8240-420b6a4b8daf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:a986f9c2-143b-5552-9d62-130e661122fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:347b025d-73ef-5f35-9880-5d035858600e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:8195593b-5efd-522a-849d-66dc44a193ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:43beef94-0456-54a5-8f8a-cc3398b821cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:aa5e4ff4-0f12-53ef-bd3e-f332e0ea9bb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:99d37bd5-6408-59b9-bded-4244cc5174ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:9a950ecf-5e08-5c5d-98d7-806a5084daab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:60d5c3cf-af91-5b47-a0a4-62c254b11024", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2025-22234. This CVE is a secondary vulnerability introduced by the fix for CVE-2025-22228, which added a password length check to BCrypt that broke timing attack mitigation. The target version (5.7.7) never received the CVE-2025-22228 fix, and therefore does not contain the problematic code that causes CVE-2025-22234. The timing attack mitigation in...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:f568a79b-ff60-50dd-a8ca-0ce5d4904f5c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.7.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:21c96eb9-93dc-5c1d-bd0e-4a2f95a47819", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging. Spring Security 5.7.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:84af6923-5fd5-53bb-9aab-713726980e08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:19fa3915-236a-5ccb-bacb-bd0520e4f524", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-22751 because the vulnerable component (JdbcOneTimeTokenService) does not exist in this version. The One-Time Token (OTT) authentication feature was introduced in Spring Security 6.4.0, and version 5.7.7 predates this feature entirely. Comprehensive searches across the codebase found no JdbcOneTimeTokenService class, no OneTimeToken-related code...", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:ed7ecbea-fbb7-5b94-8359-09af900c5e02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47842 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging, and is fixed in 5.7.7-tuxcare.2." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:7fb04a15-8892-5b90-adc7-fdb8d5fe436e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging, and is fixed in 5.7.7-tuxcare.2." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:e8bc4db6-5583-5152-858b-f2c968482379", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-messaging. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-59277. The vulnerable component, the InetAddressMatchers utility class with matchInternal()/matchExternal() builders for classifying IP addresses as internal or external networks, does not exist in this version. The CVE describes a misclassification vulnerability where 0.0.0.0 and :: are incorrectly treated as external addresses. However, versio...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@5.7.7-tuxcare.1" } ] }