{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f3e38eb6-8006-5c5d-85f6-f55ea18fc5bb", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-messaging", "purl": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2", "version": "6.5.11-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-messaging", "purl": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11", "type": "library", "group": "org.springframework.security", "version": "6.5.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:9e067221-dfc7-5c51-9eeb-bc35f31c4508", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:c113e8a0-c0ed-52ca-bd2a-693e67932072", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:65522be8-29ec-5d3c-b769-47706a706918", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:738ad743-39cc-57e4-95cc-ad4652d6811e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:83cf54ed-15a6-57a3-b2cc-b4525a11721c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:0848e735-396c-537b-8c89-17f2c1ec2a5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:2b4f4ff1-220f-5eb5-a173-ce039f8c474c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:d60a334c-e4a4-5252-86c3-dfe9b3c8edf9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:ebf92681-598c-5ee6-84e6-35f496e12bcd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:a7fe0a03-3b97-5e39-9cae-ab807c2084a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:671ba7ff-a23e-5b25-9f0c-213b4a55c8e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:0d5661e3-8406-53b0-9f47-ac3a01b4b687", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:77272cc5-2363-51ff-ad99-2bb8671644f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:68a515a4-6616-5d67-9f85-229908879a3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:61269e75-894a-508e-835f-8e198ebe8bb9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:7c440f6a-1ff0-55fc-a42e-5234ee01a592", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:a4224321-b3f4-50e0-bc1f-5f9639fd0ddc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:e47bcabd-5f39-567f-9104-7e43da64a7af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:c3a72df4-a463-54d7-9fa4-d7aaff42b536", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:49a79882-5912-5004-8614-4429d7977540", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:5aee9919-5097-5aaf-87f9-eade21a55858", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:729d0a7b-9e1d-53b3-afed-7c569a57b68a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:55fa4768-ef2b-5bbd-9340-bb927ab02b56", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:af6c317d-8733-5337-aca8-a49edb54e92e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:f9629e04-a8af-5a6e-9361-a2cfa3d80aea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:a6584c67-df17-5e87-841a-35dbbaf8724f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging. not_affected \u2014 Spring Security 6.5.11-tuxcare.4 is NOT AFFECTED by CVE-2025-22223. The vulnerability (method security annotations not being located on parameterized types/methods) was fixed by upstream Spring Security in commit dc2e1af2dab8ef81cd4edd25b56a2babeaab8cf9 (authored by Josh Cummings on 2025-01-08). This fix was already included in the upstream Spring Security 6.5.11 release that TuxCare onboarded ...", "justification": "code_not_present" } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:1f8a7de3-a8f3-59d0-b3c7-da457b7fd797", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:747b73a6-3ee1-5583-8be9-a38ebe820b0b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging. not_affected \u2014 CVE-2025-22234 is not present in spring-security 6.5.11-tuxcare.4. The vulnerability (timing attack side channel in DaoAuthenticationProvider due to CVE-2025-22228's 72-byte password limit) was fixed by upstream Spring Security maintainer Joe Grandja in commit c1aa99fdd21 (April 17, 2025), which was already included in the upstream 6.5.11 release that TuxCare onboarded. The fix adds a `for_chec...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:77f4649f-4318-5133-ac83-b3982e7c617c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging. Spring Security 6.5.11 already contains the fix for CVE-2025-41232: UniqueSecurityAnnotationScanner compares methods with equals(), so annotations on private methods are found (fixed upstream in 6.4.6).", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:793a10bb-cbfe-5816-b69d-14214826f371", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging. Spring Security 6.5.11 already contains the fix for CVE-2025-41248: UniqueSecurityAnnotationScanner resolves generic parameter types with toClass(), so annotations on methods in generic superclasses and interfaces are found (fixed upstream in 6.4.10 and 6.5.4).", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:92c1e729-e7bc-5f72-a547-53883657c976", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22746 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging. already_fixed \u2014 The target Spring Security 6.5.11 already contains the fix for CVE-2026-22746. The timing attack defense was implemented via commit a317a3d8663995daa2bc91593bb88ae2da21ea52 (April 15, 2026), which ensures constant-time authentication by always executing password verification even when account state checks fail.", "justification": "code_not_present" } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:8fabec67-0ecf-5c5f-90f3-56d04f5bb1b5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging. not_affected \u2014 The target repository (Spring Security 6.5.11-tuxcare.4) is not affected by CVE-2026-22751. The TOCTOU race condition vulnerability in JdbcOneTimeTokenService was already fixed in the upstream Spring Security 6.5.11 release that TuxCare onboarded. The vulnerable code pattern (SELECT without verifying DELETE succeeded) is not present in the target. The fix verifies that the DELETE operation remo...", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:20c61623-a649-56cc-ac48-275fdfe976d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47842 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging, and is fixed in 6.5.11-tuxcare.3." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:ed15264c-ab09-5f43-8227-bba59f00f172", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging, and is fixed in 6.5.11-tuxcare.3." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:971b7523-c48e-5436-923f-834553239bc2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-messaging. not_affected \u2014 Spring Security 6.5.11-tuxcare.4 is not affected by CVE-2026-59277. The vulnerable InetAddressMatchers class with matchInternal()/matchExternal() builders was introduced in Spring Security 7.1, but the target version is 6.5.11. The entire affected class does not exist in this version, so the vulnerability pattern cannot be present. This is a Type A1 case where the vulnerable code was not yet in...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-messaging@6.5.11-tuxcare.2" } ] }