{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:be61fa6a-de53-57f5-9e25-1328d69f5dae", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13", "version": "4.2.9.RELEASE-tuxcare.13", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE", "type": "library", "group": "org.springframework", "version": "4.2.9.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:6ed756c7-88c6-5651-b2f1-ee27b7504b11", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 4.2.9.RELEASE is not affected by CVE-2009-1190. While the framework still contains deserialization code (HttpInvokerServiceExporter) with no Spring-level filtering for Pattern objects, the vulnerability requires JDK < 1.6 to exploit. Spring 4.2.9 is compiled with Java 6 bytecode compatibility (sourceCompatibility = 1.6) and cannot run on Java 5 or earlier. The JDK 6+ runtime in...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:9043aa1a-83a1-59ad-aead-48a870c22431", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:1e1e0140-0c16-5b62-8203-5c6e07064c30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:ace162e7-94b4-5b1c-a415-239891ea292a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:25521d7f-6a43-511b-bb08-cbae16116a50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:42121a6a-aad3-5377-81eb-5ba3833d22d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:5124555f-0142-5acb-aef2-b195e128b9a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:be37f78c-c870-5c05-b182-2923d6672003", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:c567dca4-93e2-59e8-975c-730be95c30dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:1ae854ac-4280-534b-8c5c-545998a5270c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:ab30e66c-ce38-5f3b-aa5d-57cc09834d23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:b07ec9cc-892c-5882-910f-88a9e67c845a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:7758a2a1-b391-5f9a-b6ec-8149e2043611", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:397bb4dd-7645-59f2-ba21-41a900ab0c11", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:363d606d-8554-5ac4-8691-b3af6be06b1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:f50a8245-94a6-5694-a8b1-e81ae83ee782", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:68c2ef6b-da48-52c5-981e-c93732541bb9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:49841e74-7cc3-5393-b929-6505a2ab6672", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:8c689ac8-0dfc-5ff0-8ed5-d5bced83ecbc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:91616ef3-16e3-55c9-b1ca-70d6892cfb86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:b24acc75-e387-56c1-83f1-1063e29eeedf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:24a20f9e-f5cf-58c3-b5a2-dd8cadf95ab4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:cc88a157-abba-53fe-8155-6c7a1f575c1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:0dba6e6d-98e7-5255-82ad-24364ae81044", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:dedc304b-9b6f-52c0-aecb-9704a3cb5efc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:f84bbd68-4281-5134-8e70-3bd48b58021c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:14630726-f318-57f2-af8f-08866f6676ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:5705a260-2fc7-5a2d-999f-5fb12f705af7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:cc02708b-e15f-584f-b831-301543c2410a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:f9eeab6e-132e-51a9-89da-d02483e52f75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:9a970007-f1ef-5a00-9409-93972ba3bc3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:389fa73b-858c-580c-8137-7645caca0edb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:19603687-a010-5234-a482-5c547b98b6dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:869b6ab2-57c7-579f-b52e-9f9148b11a3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:f87c9f48-e4e1-5724-b879-48cea3f3bb2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:04d7e547-3ad4-5841-8825-61b8e1bcf97c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:7491b871-e35a-5aa6-b14e-f0fb0e0738f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:80b05488-fac2-5c6a-b27e-dde52fa08f46", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.2.9.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:7d4aac78-6d1b-5cf0-b792-03aa9d381289", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:5dc5c9ba-0782-59e6-b969-7ad51049865d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.2.9.RELEASE-tuxcare.13 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE-tuxcare.13" } ] }