{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:699b0230-6233-59ed-babf-58ca9dd3b697", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7", "version": "4.1.7.RELEASE-tuxcare.7", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE", "type": "library", "group": "org.springframework", "version": "4.1.7.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:a032bae8-addb-5c2a-a26e-4169b9bec289", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:9450d08a-838d-5dfb-9141-76ae19641345", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:771bc188-632d-5f8f-8637-de092fdc6f19", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:3e6d0496-0d93-5b14-afa1-d1cf49c8b487", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:bbae285d-9a62-54b6-9b35-1e1927a25a97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:8cbb1141-0fef-583b-9846-fa4e78e24988", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-5211 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:1afa7d95-0632-5cd9-8b71-1a5ce0e9998f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:57452d6e-8d65-5a84-a155-a7dc8a6db565", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:afdf24e7-581f-5b66-9fae-6607f0afb203", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:6fe19e5c-f42a-5313-bdc5-e78271ba0c5d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging. The version is not vulnerable. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:2cc034cc-1f2a-59c6-b696-ff0599193ca0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:b11d9418-7aca-5ea5-993e-a325be1454f1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1270 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging. Version 4.1.7.RELEASE is not vulnerable. Summary: The target repository (Spring Framework 4.1.7.RELEASE) does not contain the vulnerable code. CVE-2018-1270 affects the SpEL-based message selector feature in the DefaultSubscriptionRegistry class, which uses StandardEvaluationContext to evaluate expressions - allowing remote code execution. However, this feature was not introduced until version 4.2.0.RC1 (commit b6327acec8 on 2015-04-21). The target version 4.1.7.RELEASE (released 2015-06-30) predates the introduction of this vulnerable feature and therefore is not affected by this CVE.", "justification": "code_not_present" } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:2383e0b2-28b8-521e-a2f3-97421c977dce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:5e07ddd3-56d5-5791-8dcf-e302223088b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:5d7049f3-05a3-5df6-b4b3-16c421ea1382", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:a341a35b-8406-583d-bdaf-c7c9f5113dc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:688c8d1e-3f73-5f19-8f3f-f811e6f4e5db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:b6daeb11-95a3-5e84-a592-5b4a5802dbeb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:f8f4ae2d-67a5-51a6-b757-3a509f92d4ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:b3cfb764-db26-5c8d-826f-e9338f3d2d89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:459c77f7-8e26-5bc3-a7ac-8c0663a9bf71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:00425841-f6c9-5289-a925-4eb7cdeb597a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:ba047ab5-2cba-5fdc-9092-31c9d7c26906", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:8842d273-97ee-5311-9d53-2f1213f35a1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:4b39b30b-f2d4-5d7f-b277-c05217c7b99d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:e89e837d-fffc-525d-93f0-5f768bbf4117", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:82f638c9-8eec-5d3b-92e6-7597a59a443b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:afde0828-ddca-5efd-9287-3544c4220401", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:7f972320-55e0-59ff-8b96-4cf88422bea5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:cbace5f7-cdb1-5379-a9fc-44f453afeaec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:775684ca-b8d4-5c63-a3be-28464f356ce9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:1413cd14-b51c-5cb0-97f1-dddf1430eda8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:4d07cff0-a875-50c9-8019-4baa1cae1278", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:dace7b0f-68c3-5015-929a-23e86484b474", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:75ca854c-416a-52e3-94a0-4eaa2a43c240", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:0a7a9521-6d42-5347-a722-5d85ce9a641d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41852 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 4.1.7.RELEASE is not affected by CVE-2026-41852. The vulnerability requires record-style property accessor support (empty-prefix method lookup), which was introduced in Spring 5.2+ and does not exist in version 4.1.7. While this version lacks void return type validation for getter methods, it cannot invoke arbitrary zero-argument methods as described in the CVE.", "justification": "code_not_present" } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:d3f2ffef-95f1-5c3e-8cd9-46f71c3a54da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:f63a1631-1a71-5974-bf56-6f68b982d8ee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.1.7.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:1d369625-d0e7-5772-aa04-c749885853ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:2c224770-6b4b-5588-8685-10c71260d651", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE-tuxcare.7" } ] }