{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:863db1b3-91fe-572c-bca3-0547148a7bed", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-messaging", "purl": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1", "version": "6.0.7-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-messaging", "purl": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7", "type": "library", "group": "org.springframework.security", "version": "6.0.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:5378bc30-cd73-5d7a-8845-fdfb0d00f329", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:b56d8bd2-7bc9-535e-998d-a518eefdf19b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:8dee4ff7-7539-5174-b893-1f2109eba7a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:b97a3aa9-f3c1-58eb-8ee3-862198ab5994", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:12577cf5-834f-5257-b163-3cb105195f08", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:bafae034-22cd-524c-b5d0-910c1863ba37", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:f6222c08-b5f9-5a7b-a974-c3b6c5085e3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:21e6147a-8e0f-5b1f-91d5-aa828911651a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:4ff9c0c7-3eba-5629-ac82-d2190d3210bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:7e641b72-0b48-5b24-8951-8fdabf6429cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:9a21713a-2fd6-5469-b38b-8bad1126acb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:27eef0cf-94ce-5cea-b675-c2a645e1194e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:1571ce8a-7706-582e-a747-0dbe72ded5ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:588c1e0b-5831-53ff-b630-23449db75a22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:11d1c67b-91cc-5869-803e-9a11d467dfd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:c4094995-93d1-5552-84b7-79a4259c1abf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:7ee96767-7634-5e5b-84b4-ae6a94d42730", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:83aeac95-07f9-5e26-a279-89251bdd2aa9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:8f2e827c-1f2d-5db2-83c4-6e06329dfe1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:4b3ba866-feee-5754-8272-317f8c208fce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:e33c96c8-7d05-50c5-9392-9866f12167e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:476d064c-e166-5102-9066-5b86886791a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:1777715b-9636-505a-8b25-42bc93d6f869", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:b8548e30-e5a4-5c6a-a61e-85183dc3bc84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:4a447bbc-f4f4-5a11-a7ce-240074c61077", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:8b751d39-8de6-5bed-a59e-1c931a4f8333", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:912d7676-dc3c-51a3-ac87-85a3c3fc1198", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:1b929e42-59d8-59df-850e-b5809095dc6a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:d77e59e4-cb3b-582a-a2ed-8767923e87aa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 6.0.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:ef690324-2034-54d3-8d82-65cea6d4c081", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging. Spring Security 6.0.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:3b698b44-6487-5f12-b64a-a35e2b4db52b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:99856965-8eea-5aaf-95e3-86bd3705e9c7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging. not_affected \u2014 CVE-2026-22751 does not affect Spring Security 6.0.7. The vulnerable component (JdbcOneTimeTokenService) and the entire One-Time Token (OTT) authentication feature were introduced in Spring Security 6.4.0-RC1, which postdates version 6.0.7 by several minor versions. The target codebase contains no OTT-related code, classes, or interfaces. This is a Rule 5 Type A1 case: the INPUT type (one-time ...", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:9b4bfdca-c497-5420-9f62-c2ea8b8a79cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:456457d4-9884-5f5c-a758-47e0683d7502", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:53ff0cad-9438-5655-8632-f7b7365977e9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-messaging. not_affected \u2014 Spring Security 6.0.7 is NOT AFFECTED by CVE-2026-59277. The vulnerable component `InetAddressMatchers` and its `matchInternal()`/`matchExternal()` methods do not exist in this version. The class was introduced in Spring Security 7.1 (confirmed via upstream @since annotation), several major versions after 6.0.7. While version 6.0.7 processes IP addresses via `IpAddressMatcher`, this class only ...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.1" } ] }