{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8abb2c8e-8370-53e3-8dc3-f910da3acd21", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2", "version": "4.3.20.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.20.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:63035685-077c-5b1e-abd7-b838feb42a6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d058153b-0d53-5d24-b284-f602ce26e5f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ffaef439-80fb-5fec-bc0b-4f595d4841da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5317ad4c-e7bd-50e4-9c61-c49e69456b14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:42f507dd-02e7-5ca2-b954-80b8fb92bbdd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8af167b4-a94c-527e-b70e-af721412b0e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e2bc0b4c-6611-5567-8e06-0fbe04201c8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b3948872-8560-525f-8da0-228f610bd2f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c7aae792-4595-56bf-b5c6-ad58915e39b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:233e42e5-629e-5f89-b9e8-d95c66dc0f6c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging. not_affected \u2014 Target version 4.3.20.RELEASE is not affected by CVE-2018-1257. The vulnerability (regex DoS via malicious SpEL expressions in STOMP selector headers) was fixed by upstream Spring Framework in version 4.3.17 through two defensive measures: (1) switching from StandardEvaluationContext to SimpleEvaluationContext to restrict expression capabilities, and (2) adding configuration support to disable ...", "justification": "protected_at_runtime" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:64aa4604-8da3-5cbf-9131-d2393459414b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b9b54dc5-a53c-5ae7-af90-bad4589f522d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:59710563-6a1a-56cb-958e-5c72c3e41e66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:767017ba-4502-5cc8-94ca-42d43404e9bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c65f344e-b240-5d04-9425-441645668b0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d6ff1bcc-5211-50dd-831e-cad0626de56b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:12e6113b-a845-5442-b68b-36780dc263fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1b848786-31d0-51a0-a7f2-82f97e300140", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:82175b10-8de8-5732-8888-7d6355ddd40b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b4e84206-9d7f-5c31-a9df-45118a9de3cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:47ae0212-32d0-5e6e-942d-f38cdcec0207", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:941d7831-9c83-55fc-9cc4-4af0c172cd91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:93b25443-7fb6-512c-b7b2-d9f4862d8532", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:123acee6-bd0d-54df-9013-63127ab17026", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:55f3b8f2-01a4-5670-b113-bc03272c4694", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e6e665dd-335a-5bf1-92ff-bafcbd5765ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bf88f9ce-0e41-5a89-bf07-053ee1c9f146", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:359c5d78-e52f-5dbc-b296-a6de13d59ff1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging. not_affected \u2014 Version 4.3.20.RELEASE (released October 2018) predates CVE-2024-38820 (2024) and its prerequisite CVE-2022-22968 (2022). The target uses case-sensitive pattern matching in DataBinder with no toLowerCase() calls. CVE-2024-38820 specifically addresses \"String.toLowerCase() has some Locale dependent exceptions\" - this vulnerable code pattern is not present in the target. The target was released 4...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f61da0f5-cde5-5d11-b75a-bb237b8993b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:33ec1b6c-0d66-54e7-af3b-16b650d30fa1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d04762ec-e310-5205-bbe1-19e15a8f3610", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a25aa29f-31d5-5039-8bdf-12eb106d14a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6d34d901-9515-5d3a-a02d-3b4eadf07885", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:92bbffcd-d2e0-5190-9aa5-c34890b5de80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ab9a88c3-c1d0-57bb-b205-0c7cfe813419", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:099ef2e1-8af6-5734-8622-026083ec17a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:534860e9-9d0e-5f71-b4d6-d55baf9ee432", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.3.20.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1548ecfe-e85f-500f-8da3-165dbd82bf41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:60e90b63-7f24-5c75-8d6c-3a432f6ff61b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2" } ] }