{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6d1d47d5-9b6e-5d11-9baa-5c517c1df14e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-messaging", "purl": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20", "version": "6.3.10-tuxcare.20", "pedigree": { "ancestors": [ { "name": "spring-security-messaging", "purl": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10", "type": "library", "group": "org.springframework.security", "version": "6.3.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:e15af1ec-5cc0-5de2-b016-5ff28316c7ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:65589177-70d2-5654-b23e-78344c11bca6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:8a440ac5-b770-54bd-b111-ab0544e42c0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:4f6fad47-b53f-538b-88d5-f4a2c000710e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:7a61943f-121a-5b24-b574-fc240207f3a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:5f2413cc-0c81-51c1-ba13-0c854bf047d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:6b8c7ac8-12a5-583f-86b4-8656bf47a069", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:72f97f8a-0bab-5c52-afa2-d8bf12684813", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:3e0d50f8-952c-5a9b-be53-8bd17fa75f9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:e5029f84-6c74-5e67-b576-770d11439a39", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:26831a0a-d016-5da7-90ad-bf5d23ba5cd1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:6b58d938-7556-5181-852e-de559a77fec3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1258 does not affect version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging. not_affected \u2014 The target Spring Security 6.3.10-tuxcare.7 is not affected by CVE-2018-1258. The vulnerability existed in Spring Framework versions 5.0.5/5.0.6 and was fixed in Spring Framework 5.0.7 (June 2018). The target depends on Spring Framework 6.1.20-tuxcare.5, which is approximately 6 years newer than the fixed version and contains all security fixes from 5.0.7 onwards.", "justification": "requires_dependency" } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:9095b418-ec70-53b9-8f15-c46b1422de95", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:ff313705-8365-5577-8bc5-ef4e60377caa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:d40fd8d0-e540-5c5e-afc0-e73603a4d661", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:7b119a97-c33c-5fad-afb2-2576765b0a37", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:9a301a94-caac-5002-bef1-b2ff2fc8352d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:9a969e4f-63a6-5406-9cbb-ca5d7780a49c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:d4990d2f-f2c8-5f82-89c0-396b1a64d565", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:cd57b69b-df3c-5d9d-b393-812c999e5b78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:f9d65166-f034-56c5-b25f-5b472ce1cb89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:3f5fdfe1-778d-58fd-96fb-f53252ec58a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:dbbaca75-1577-5b53-992e-f58e4c67b00d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:5b78deec-1fd9-5dd4-9e1c-996e0480efc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:ad3cec5e-21a0-5f27-9db9-3dd6d949c7df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:7ba7d9f0-a04a-5e6e-bec5-f9f673146842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:847b1512-d41e-532b-8e77-f37ca1e5bba7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:939b91b2-7cbd-5451-a426-a7414a22641a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:0f9fedb5-3a9b-5c91-96b1-e7dbbe492bd0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging. not_affected \u2014 The target repository (spring-security 6.3.10-tuxcare.21) is NOT AFFECTED by CVE-2025-22234. The vulnerability was fixed by upstream Spring Security in commit c1aa99fdd2113a232986e9c3a44673ae752de840 (dated 2025-04-17) before TuxCare onboarded version 6.3.10. The fix conditionalizes the 72-byte password length check to only apply when encoding new passwords (!for_check), not during authenticati...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:c3e0a9d7-5960-5ed8-96cf-47cec32cbb12", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging. Spring Security 6.3.10 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:b7c41680-784a-54a1-8d82-277d8064e9e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:832463b4-af7a-5483-8b65-2862447a9add", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:5810ad0e-7167-5841-ab29-e930640b4640", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging. not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.4.0, which postdates this target version. The one-time token authentication feature does not exist in 6.3.10.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:bb6beaac-92b3-5ceb-aa2a-40dcfaed9cd0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:b8126177-4a45-55c1-af2b-b0d6f4e1dc7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:593192b1-97af-5f01-a9aa-a3ec37f063fc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-messaging. not_affected \u2014 Spring Security 6.3.10 does not contain the InetAddressMatchers class or its matchInternal()/matchExternal() methods that are affected by CVE-2026-59277. The vulnerability concerns incorrect classification of \"any local\" addresses (0.0.0.0 and ::) as external rather than internal. This functionality was introduced in a later version of Spring Security (patches dated June/July 2026, after the 6....", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.20" } ] }