{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b98e98ca-177f-5552-9e03-21ff25c25c49", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1", "version": "4.3.20.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.20.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7e7f97c0-648e-5be0-a1e9-f204fae9ddb7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:819517cc-d68f-5095-8fdf-e9f35e78d6f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:46da9dda-546e-50e3-95dc-f89f4d684d34", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c969e24c-779a-582c-90cb-c67c414a4be7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fb094138-f6f8-5b68-b6bf-600942eed45e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:257be30a-8c4a-5be8-8d42-3d8da55b62ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e1fff719-bad9-5a19-b87c-3764df4c6957", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:32f8030a-933e-5b3f-8898-46e8fcbf2c2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:46b5375f-073b-592e-b9f1-6116eeac7d6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5d6081a6-f263-567c-9c8e-9cdf5879a45e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging. not_affected \u2014 Target version 4.3.20.RELEASE is not affected by CVE-2018-1257. The vulnerability (regex DoS via malicious SpEL expressions in STOMP selector headers) was fixed by upstream Spring Framework in version 4.3.17 through two defensive measures: (1) switching from StandardEvaluationContext to SimpleEvaluationContext to restrict expression capabilities, and (2) adding configuration support to disable ...", "justification": "protected_at_runtime" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e274dd37-7620-5845-afe7-f93e3e8be2fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8e1decf6-52c9-5b4e-9b41-7cdc743d160b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f0887b5c-22ed-5c33-af9b-0d4586e614c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9db591e0-9413-5010-9981-78880731a917", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:df68e4e0-c675-5b48-9932-972f68514179", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4da3ae50-4512-5758-962b-5be34ecb5452", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:203334b8-b1b9-5f73-bfa5-60676a074c3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1c9a5e77-4e95-527d-bae1-9e22841e82c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8a1fb755-63bb-57ab-9cf4-41fd3d4f05fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging, and is fixed in 4.3.20.RELEASE-tuxcare.2." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:23969e3f-eb42-572c-be44-b322d0416f8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e7cb8e4e-0916-522c-ae03-99ad2ea68a1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:96e7e662-df8d-5fce-9a46-651b4fcebfb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9159d302-09c7-5b39-8476-0359bbbab4e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5fdd7db9-9aa8-5d80-8edc-d88a1f8775a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1e134683-07d2-5aa7-8e3b-06f44aa6c302", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6c5bc525-bbf6-5f8a-a98d-bac66f49e837", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d9c889c5-00bf-503f-98b0-4307b5eca93f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1b45f848-98b6-52c9-8846-8e3147403f4b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging. not_affected \u2014 Version 4.3.20.RELEASE (released October 2018) predates CVE-2024-38820 (2024) and its prerequisite CVE-2022-22968 (2022). The target uses case-sensitive pattern matching in DataBinder with no toLowerCase() calls. CVE-2024-38820 specifically addresses \"String.toLowerCase() has some Locale dependent exceptions\" - this vulnerable code pattern is not present in the target. The target was released 4...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4aa6cb8b-2985-53e6-97f2-c9ceae0cfd2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c3a34be2-594e-5d82-9615-f9d266a75784", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2d054d51-e891-5591-8d46-4acf6db1692e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:05bc3fa0-51fb-5c8b-bd01-93de3a54fb49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0d7426ab-d008-55f4-9c5b-212bc13a961a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:dcbdebac-12f9-52f7-b071-0253cc2fe0bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0cb1d740-e1c3-5e76-8f2e-b91453675cdd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:adfd56ef-6858-5b25-91da-fa6bc79c1ef1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b31c8a2d-3907-5a89-9f56-b648e0267dc2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.3.20.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4ff582dd-e17c-5099-bcb8-31eaa5e1acfd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ce01f6b9-0291-5337-97df-ace2be7f508d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.1" } ] }