{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:be8ab13d-4a4e-506b-a6c0-eecc79d1e37a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-messaging", "purl": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4", "version": "6.0.8-tuxcare.4", "pedigree": { "ancestors": [ { "name": "spring-security-messaging", "purl": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8", "type": "library", "group": "org.springframework.security", "version": "6.0.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:2a92f8e8-0e39-59a4-8247-dec3364c52e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:a9b3060e-a93d-5e0a-ad01-3c5ca72c56d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:f56f7d08-41d6-5872-861b-ee687a3f54d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:103155a7-3f5c-5632-af29-5dec020d7880", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:db482824-ddc6-5cab-afba-9f3a437112a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:7c5fe9e2-4ee5-57c0-980d-56c214946df4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:44e5bf3c-9fac-5a5e-9b03-f03404c6db54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:3d43c5f6-5e7e-56bb-a82f-5ec4ffcf3ea1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:1e0b4910-dcf0-5ced-b92f-63979335f1f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:22bd5a8f-19a0-501b-ba63-2a00cba798d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:c04a0b27-5d85-55d7-8b0b-ae11f180eb75", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:58927e69-86dc-5359-a1b3-fbd15b3056d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:3df389d6-6773-570c-865d-927a38d8c6fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:fe009722-852e-5ed0-af58-5fd2f54ff935", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:d4c29c03-aa8a-55b6-870a-2c0610d13ead", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:fe2a08eb-e8f1-5130-a48d-97112a498a9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:08151675-3e6b-5815-9af4-e8f29069605e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:9a4ac79d-011b-5b45-abbd-8e00aff007b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:53cc18ea-08aa-5071-a787-ee6cd3f95b34", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:e3e95d17-1572-5c96-b3ea-add4005b82f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:e079a5bc-0bbf-5425-90d1-8d708ae66033", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:e7ab84a4-d7f7-52f0-b15d-cf0a66a02bae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:37a0e409-9c93-5558-87b2-1cec2a04dda4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:c62c5dc9-9aae-5abe-85ea-1c3416f2c91c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:986e9a8d-4b54-5d57-bc47-4f82c4f293fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:1b62b78b-94d3-5a88-95e5-808c63205959", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:f823c936-8fd9-5270-ba13-1f0644abaff6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:2281f570-a709-543e-a144-ad56aeb7e260", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:8e992d74-3610-5e18-8cd8-ca60f6fa991d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging. Spring Security 6.0.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:6cb23850-87e4-5408-8775-ec6be9242ce7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:e6889b81-72f6-5250-a040-3741ce3ae9cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:94fbced6-7857-5fb9-aceb-c1405d85c346", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging. not_affected \u2014 Spring Security version 6.0.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire one-time token authentication feature) does not exist in this version. The one-time token login feature was introduced in Spring Security 6.4.0-RC1, released after version 6.0.8. Exhaustive searches across the codebase confirmed no OneTimeToken classes, JdbcOneTimeTo...", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:d0c7cc27-1b03-50c2-96b0-05800bd05c98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:565ebf3b-4af2-5790-9d06-f3eef6060d88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:698974a4-b71c-5991-a4dd-5719090321bf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-messaging. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-59277. The vulnerability exists in the `InetAddressMatchers` utility class with its `matchInternal()` and `matchExternal()` methods, which do not exist in version 6.0.8. This class was introduced in a later version of Spring Security (after 6.5.11). Without this utility, there is no mechanism to classify IP addresses as internal/external, and th...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.0.8-tuxcare.4" } ] }