{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:62b56afb-8f92-5d1b-a6d5-1de611aadebc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-messaging", "purl": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21", "version": "6.3.10-tuxcare.21", "pedigree": { "ancestors": [ { "name": "spring-security-messaging", "purl": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10", "type": "library", "group": "org.springframework.security", "version": "6.3.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:cec1088d-6ad7-5e23-ba33-8df7d2c51fd0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:596859f3-7d16-5018-b30b-2f6a1882bb1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:8b9d7f55-1224-5d81-828c-142577dc81ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:d5432d51-f94a-5cb4-b7c8-c235167b2685", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:48028a95-1245-511f-8625-39ac7de12221", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:91ebe719-ead7-589d-b59a-362a2a8fd45c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:0b4835b3-eba0-5a36-a92f-b4628eea4dd2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:526a7dd9-bd8f-5742-874b-a3ca98029dd2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:1d4b97d8-c6bd-5606-b410-c71077285b1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:20e32465-af2d-5d7f-a8e7-9e21346f64dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:acb4d681-514b-528a-80eb-6bc7dffb5e26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:7f058d42-d375-5d57-be95-edac56c52025", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1258 does not affect version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging. not_affected \u2014 The target Spring Security 6.3.10-tuxcare.7 is not affected by CVE-2018-1258. The vulnerability existed in Spring Framework versions 5.0.5/5.0.6 and was fixed in Spring Framework 5.0.7 (June 2018). The target depends on Spring Framework 6.1.20-tuxcare.5, which is approximately 6 years newer than the fixed version and contains all security fixes from 5.0.7 onwards.", "justification": "requires_dependency" } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:5130bd11-c484-59c3-8807-42b5ff5c0f29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:7754efa5-d66d-5f7f-bd96-e1f9c9e6b27f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:888ab0fe-3459-5bc2-9fd7-632f954276f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:a755325e-80ce-5601-927e-f5ebcf9adc5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:9688695b-51d0-5e87-9438-3f3a6d47d5c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:b5ed8771-f37a-58a7-811c-891332099f98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:2234b760-67b2-55c7-9bef-319d961657a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:175a10c7-818d-5170-abf4-6988cb53d0c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:e1f514c8-4a72-579a-a3c9-91fb5e5f05d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:15468481-3a62-55db-85bd-89f7e0d63f4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:741e6251-72dc-5e6a-974f-33384b3d8e70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:816deaf6-854f-57dd-b621-5408ff5f7296", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:d6e6932a-5be6-550a-8b66-7941aaca436f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:d1d5df7e-dd33-58ec-9662-ebc4ed6ce4a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:bbd94850-29e7-5524-942c-1b8ee157e387", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:e58e3fc8-5c66-58f5-86d1-0d14af6016b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:c7c5beb4-4c45-5736-9536-9ad1bdb5720f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging. not_affected \u2014 The target repository (spring-security 6.3.10-tuxcare.21) is NOT AFFECTED by CVE-2025-22234. The vulnerability was fixed by upstream Spring Security in commit c1aa99fdd2113a232986e9c3a44673ae752de840 (dated 2025-04-17) before TuxCare onboarded version 6.3.10. The fix conditionalizes the 72-byte password length check to only apply when encoding new passwords (!for_check), not during authenticati...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:af14e847-17c1-5a0a-97f5-70d6f65c7f26", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging. Spring Security 6.3.10 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:cff5c7cf-63a3-58d6-aa2f-9dc1ba78174a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:d7564990-8e14-558b-b523-0b72625500ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:ba3f7bd5-1b84-54a1-a1fe-509aa2b08ac5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging. not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.4.0, which postdates this target version. The one-time token authentication feature does not exist in 6.3.10.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:3ba41fbd-d1ae-501f-b8bd-61d9513b0a4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:7d4ef9ec-811d-5f5b-93a6-ec4b2682a62c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:d0691ecb-7e6d-5fdc-a6c9-a583213dc0f2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-messaging. not_affected \u2014 Spring Security 6.3.10 does not contain the InetAddressMatchers class or its matchInternal()/matchExternal() methods that are affected by CVE-2026-59277. The vulnerability concerns incorrect classification of \"any local\" addresses (0.0.0.0 and ::) as external rather than internal. This functionality was introduced in a later version of Spring Security (patches dated June/July 2026, after the 6....", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.3.10-tuxcare.21" } ] }