{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:39edaa22-d450-54d3-a5df-29da374676d7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6", "version": "4.3.25.RELEASE-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.25.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a53db81d-a6fb-5aed-ae42-1e55c4c9869f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:4c50a28c-c7a9-546b-a391-b3a11fcd7161", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7ed0061f-cf81-555e-ac41-f9eb60f87b1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:f4035fa3-8546-52df-9230-743a302ca4f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9a3d4c0b-1489-5c6d-aebf-3ce3c1436d47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:2677fbdd-a94b-5d8a-8b6f-00065e46bb73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:301e9762-0683-5047-931b-5b170f5bc543", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:806ba232-e5d8-5c36-982f-105b30901a4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d81ce4e5-701b-5db3-8789-f829df20067d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:45a8426f-4bdd-5e35-86c2-2c01496c2dbb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging. not_affected \u2014 Target version 4.3.25.RELEASE already contains the upstream vendor fix for CVE-2018-1257 that shipped in Spring Framework v4.3.17.RELEASE. The fix (commit 246a6db1ca) adds a null-check guard and makes the vulnerable selector header feature configurable so administrators can disable it to prevent ReDoS attacks. The fix code is present at DefaultSubscriptionRegistry.java:154 and SimpleBrokerMessa...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7ec2a03e-3589-57a6-a64f-933f409dc440", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a562ef2f-b643-5e43-937c-8808efe845b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0c7a5b41-4a7e-5558-871a-403b23bb79b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:fc52b41f-9e26-51ba-af17-56de4db6b8e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:8cfaaada-6401-5ffa-aa3a-5af8dcb914c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:df07da7f-57e8-5516-8589-9541dbdeec7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c6357cf0-4e95-55da-a75c-2d4f1f061aef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0fcb73ae-e48c-5bcd-81e1-dba4279b2896", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:8beafd19-2296-5358-9ba6-fc4bf4abedd3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:20a5e076-aa3d-541b-83c8-76e96578c37e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a976e4f4-e660-5cc1-805c-eec799b6de5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b6773810-b078-54f1-a644-77b597b505a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:bcdf3580-6ea5-55c4-b071-088d2644d974", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:cd8ec026-a112-5477-aeb7-6baa572a93c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:72f5af46-4716-57bf-9f4f-dbe23e288a6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:fa903c60-8440-5a1a-9a22-898e7de8030e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3b037918-d406-5b0d-bcd1-7628bf723ac4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:90be27d4-9c22-5892-b44a-e414ad1692c2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging. not_affected \u2014 The target Spring Framework version 4.3.25.RELEASE is not affected by CVE-2024-38820. This CVE addresses a locale-dependent case conversion flaw in the CVE-2022-22968 fix. The target version does not have the CVE-2022-22968 fix and therefore does not perform the toLowerCase() operations that CVE-2024-38820 addresses.", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7d2e966b-8db3-5fcf-97e0-7f3d70d82831", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7d3c1be5-dcfc-56b4-a76b-320b08604dda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:bc474f4f-7084-57a6-a126-75633c08a76b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 4.3.25.RELEASE is not affected by CVE-2026-22740. The vulnerability exists in WebFlux reactive multipart handling (introduced in Spring 5.0), which is absent from the 4.x series. Version 4.3.x uses servlet-based synchronous multipart processing with explicit cleanup mechanisms that prevent temp file leaks.", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1d117127-70f7-53ba-9b17-6310873e03cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:8d3d73dc-6813-56bc-8178-600f2a29dc7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:61e09266-41b1-5db6-a66d-d4c5be2f391b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7f726f25-02a5-5daa-86ea-f69c21020f15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7aa39e22-28cf-5b1d-9296-4bfce24a01b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:44a84cba-2fc4-55c9-b1b0-24bf65c155df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3c6255be-0094-5809-8132-ff2ba368e8ce", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.3.25.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9b99a83a-6a99-53fc-a53e-982eb1bd6781", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:bd56437d-6342-5d28-8abf-85a87df9b922", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.6" } ] }