{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dbb33664-abc0-522d-aa01-af850b21db49", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12", "version": "4.2.9.RELEASE-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE", "type": "library", "group": "org.springframework", "version": "4.2.9.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:8060e900-88b2-5edf-bdd3-30853d81a34e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:c96d8a36-eed5-5f30-989f-7cb70312d349", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:60f2dbbc-f477-5ad5-8402-d9cee34b393e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:6a8855fd-8b02-5713-8f10-55743613678b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:0f0f23a1-a680-5af4-8ecd-0b8719ac957a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:e7319a0f-6726-5671-95b1-b3dc8087cb23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:571869ff-bd30-568a-8d7e-5c77bd41bbe8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:14cd3f38-1619-53e4-8fb1-8c0f98a7f12c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:3f6e11e3-e29e-5703-b729-6e0daacd4c93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:30023186-ca7d-53cd-bc72-25e8eafb65ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:266ac959-6e6c-502d-969a-656600481281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:a1e5448a-ad44-54fb-8d7f-eec80c2d9bbc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:c616b6bd-3c97-5e94-b710-bb549dd629eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:6e842b4b-59be-5cfd-aa67-fac9b1fbc828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:7b06db0a-99d6-514b-ad0a-279bbe27eba5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:7d3171a6-ff8e-5f06-9667-82f396c536b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:14076d96-b794-58bf-b8e4-ebcb2480d1c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:ab24ff83-c4aa-582b-8040-8c1b9490d5e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging, and is fixed in 4.2.9.RELEASE-tuxcare.13." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:bcb2d62a-61e2-545f-90ba-729935d45354", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:522b51cd-5c5b-5518-81ad-3e25b3a49911", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:e5b8b9ad-244a-5df3-ac08-1082654d8f39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:1331e65b-7156-5880-a5ae-02764a00995b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:537978f5-b4d3-5675-97eb-5729668065ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:28bca418-dcbf-5bcc-b30c-255e50e571b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:e1afe51a-8571-529c-855d-556e3f0137f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:bcdcf39c-8296-58fc-a9a1-2dee8693b2b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:ee0ebdea-2ce0-5157-abae-383b7db570ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:7613a064-25c9-5f0e-af45-a34511dbdafc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:5b1f3f60-5e86-59d2-8b61-b81a4f3a41bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:a1fb34a7-88ce-54ed-b18e-8fe5ae65fb01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:0ec9550d-bac6-593c-adc0-310406daf554", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:0fdb24bf-8b4a-5d8d-94e8-ec08887e9c9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:5d003c4c-8470-5b02-8383-532a198649bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:b590a2de-d2d7-5029-8013-808adc150e5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:4d598ec3-2106-557d-b1c6-e46d934e61bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:d18498fc-31a8-550b-ab60-22154bfa3389", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:18a6f38e-f8db-5f68-bb36-30822c062558", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:bdda0e7b-85ce-57cb-9d31-629318427a40", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.2.9.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:393b6389-c292-5529-bbdc-60af2f099816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:c7ab483d-ba7f-5853-8144-e61bd977e5d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.12" } ] }