{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cb11f185-5955-5d0d-bbf5-6a4201d5bd5d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-messaging", "purl": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2", "version": "6.0.7-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-messaging", "purl": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7", "type": "library", "group": "org.springframework.security", "version": "6.0.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:bfbf792a-fc27-5c7a-9344-7fff813bb95a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:faada59f-b440-57bd-a78b-b1077478f6c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:1076fd79-321a-5916-9f6e-39ce22818482", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:42879798-83de-517d-8cf8-b4fca4a7dfb0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:c4de4f4e-54ab-5416-9546-8945ed46ff87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:e3b801fb-1c5a-5bd6-9119-faf21e5934eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:95969d7a-d555-5433-bee9-932468702337", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:1097e0bb-4e74-5abe-8a75-38c41707aa93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:628bb736-c282-5aa2-8453-66b652412083", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:3df66b75-7172-56fe-9880-1ac9cce709e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:729c1ebf-279d-5388-b49d-d65c896cdc1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:d6d98895-5313-5499-8480-c6183f51a55c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:dcf628b2-fc27-5106-9ca8-d760f6a084e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:266afbf9-d777-5cb5-aff7-b112e08e9a9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:15bb37b7-5fb1-50b4-be81-a17e71510b29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:92052506-1ff9-56eb-a48c-1ccfece3189a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:00daf17a-6764-567b-81e4-05352f1f4083", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:a211a8da-73fd-5813-b152-00b7ff2d79c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:242c3a9c-3a3a-5cdb-9479-1078a65e0bca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:3dbb836d-f8cc-5326-bcd6-d0843be4ba67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:28029cfd-6ff9-5eb9-8a1c-e89104c52c7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:742637f7-c5c0-57f2-89f4-3d1c7b07a17a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:28c9040b-6db6-5c0e-8b7e-358512cf9bf3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:cbd5fbd8-5c55-5ab8-8901-95be1d3e1355", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:9cf9f925-409d-5f12-a8ce-2f168fda3db7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:58e819d9-a0b4-5572-83e8-5a927d671cde", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:f1fc9ab0-d764-50cf-a12a-ee830b031876", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:451b2e8d-bbd8-59d0-92f0-eee9767ea1ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:07f8c20b-be2d-51ac-8c5b-3c0945345535", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41232 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:d838dbf5-e056-55f5-92bd-997aded85d70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:f634172d-87fb-5f02-bff2-662b269f53d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:dab07e12-1f11-5263-95a3-1c02541880cc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging. not_affected \u2014 CVE-2026-22751 does not affect Spring Security 6.0.7. The vulnerable component (JdbcOneTimeTokenService) and the entire One-Time Token (OTT) authentication feature were introduced in Spring Security 6.4.0-RC1, which postdates version 6.0.7 by several minor versions. The target codebase contains no OTT-related code, classes, or interfaces. This is a Rule 5 Type A1 case: the INPUT type (one-time ...", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:4d2b5aa4-1197-5b1d-a3d0-8409da60c32d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:b87c4fc6-b710-5ae4-b482-9bae4463c490", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:1d78012d-3112-589f-9554-471f1258e910", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-messaging. not_affected \u2014 Spring Security 6.0.7 is NOT AFFECTED by CVE-2026-59277. The vulnerable component `InetAddressMatchers` and its `matchInternal()`/`matchExternal()` methods do not exist in this version. The class was introduced in Spring Security 7.1 (confirmed via upstream @since annotation), several major versions after 6.0.7. While version 6.0.7 processes IP addresses via `IpAddressMatcher`, this class only ...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.7-tuxcare.2" } ] }