{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a4dfb8d9-8fea-5945-9c2b-a6023da33c75", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-messaging", "purl": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19", "version": "6.3.10-tuxcare.19", "pedigree": { "ancestors": [ { "name": "spring-security-messaging", "purl": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10", "type": "library", "group": "org.springframework.security", "version": "6.3.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:cd7b335d-18a8-57a2-87d7-21642456fc25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:83ccc4f7-0cf5-52fa-a231-46b4aa071d8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:e76a8d02-c283-5624-b873-6460d230bb51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:7618f073-4c1a-5533-b713-06b020e55fe5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:0ff69227-75fb-5580-96cb-3db5a0524e08", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:c543e4c7-455e-53dc-8e27-16d76a4fe5b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:8aac093f-a7e6-5cc6-9e46-3c5673cedc8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:9f4bfef0-530d-59a4-a4c5-e21abd44f68c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:a79bef6a-7157-53c5-a265-62bd367bec8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:fdbfe2a3-3f47-5dbc-ad63-f3fbdb9ad55a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:201e2e20-e00a-53da-a9d7-b51ac757e713", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:9dc19463-0e89-5f73-8d76-eaea59741bf5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1258 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging. not_affected \u2014 The target Spring Security 6.3.10-tuxcare.7 is not affected by CVE-2018-1258. The vulnerability existed in Spring Framework versions 5.0.5/5.0.6 and was fixed in Spring Framework 5.0.7 (June 2018). The target depends on Spring Framework 6.1.20-tuxcare.5, which is approximately 6 years newer than the fixed version and contains all security fixes from 5.0.7 onwards.", "justification": "requires_dependency" } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:3f49cf03-b982-561f-9466-097a19a7b46a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:b59ab62e-cd79-5f2c-8db5-433ec67cecce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:f8297564-11e0-5133-bb29-0640ea1ddd7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:9a5c6f0f-6783-5438-8320-26c52c18ab17", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:0b8c7245-e0a0-5f9a-96ee-baba5df1eb45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:0b57497c-4a47-5cb2-a542-963ce2951353", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:c141ee20-1952-5337-b629-db3642de1b28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:697eb915-cbea-52d9-b9b7-8aaf124253fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:3843cc22-941e-53af-8084-9793dc9a4ee6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:2ca38c12-1484-5ac9-aff9-9a13a512d1bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:720e23f7-b34b-5a2d-8a75-04dc23abb44b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:b11e920a-6cf0-5298-8228-220ef7317be6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:ac8d7170-3e24-5953-a7b6-b5d1cb6d92a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:a74970e7-9881-5b70-83fd-7d58dd95ba2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:b93b337f-9217-5bc4-bc03-9e6e3f6ae42e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:a036b116-22b6-5657-a4fe-e44b518633ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:1cf939b1-c9ab-5ebf-8d50-734ce91096a6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging. not_affected \u2014 The target repository (spring-security 6.3.10-tuxcare.21) is NOT AFFECTED by CVE-2025-22234. The vulnerability was fixed by upstream Spring Security in commit c1aa99fdd2113a232986e9c3a44673ae752de840 (dated 2025-04-17) before TuxCare onboarded version 6.3.10. The fix conditionalizes the 72-byte password length check to only apply when encoding new passwords (!for_check), not during authenticati...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:c66a0aaa-f788-55f5-bc8f-08d1b0b6f19b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging. Spring Security 6.3.10 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:0993ee0a-51e6-53cf-8682-449020142bc8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:d786bfd5-0085-5fc5-a1df-5b0dd7a16721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:e7dc5775-be28-5df1-ad99-09917da98cbc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging. not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.4.0, which postdates this target version. The one-time token authentication feature does not exist in 6.3.10.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:db4d489b-ecce-5533-9400-27923c83995b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47842 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging, and is fixed in 6.3.10-tuxcare.20." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:6b2f9b60-ff2a-5c78-a0a0-12c5eaa565d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging, and is fixed in 6.3.10-tuxcare.20." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:34469a0b-4358-5f58-9f17-5ead4a4d3582", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-messaging. not_affected \u2014 Spring Security 6.3.10 does not contain the InetAddressMatchers class or its matchInternal()/matchExternal() methods that are affected by CVE-2026-59277. The vulnerability concerns incorrect classification of \"any local\" addresses (0.0.0.0 and ::) as external rather than internal. This functionality was introduced in a later version of Spring Security (patches dated June/July 2026, after the 6....", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.19" } ] }