{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8c2a17d3-8482-5ce6-9d31-7b4bfee66fe4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5", "version": "4.3.4.RELEASE-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.4.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c5e6eb9f-8cfc-5d44-9111-76751628aa35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:7b8af423-5147-5722-9a0e-32f3c2398b4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:794ccf9c-629d-5ef5-ab12-640d216d5a52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:8fbb2481-7e8e-515a-a92e-6258351a6b30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:253000ae-0770-5d37-b698-15b742f33899", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1f405f5f-20ef-5ffc-831d-65305f815a60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:5c96357a-1704-57bf-82cd-7bc1e6ce83f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:97fc4549-cdbd-5384-bb27-85df3e5a640c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:be8c3b5a-5513-552f-9c3d-36ed51e44835", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:47c9f1bb-d176-5690-bc15-a2dfa2f489a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:25d490b4-a4c8-5269-b1ed-2d9dd4c78dc5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:8107624b-566c-505f-831e-3ed7a95c21e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:7c678991-262b-5fbb-b756-3425044597f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1319da8f-0148-5afe-b07e-97745336c7ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f0bfe55e-2e90-5f24-9bab-0d843a7f7eef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:10abce20-eae0-526a-822a-6e247862d631", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:6b8d30e6-0ab0-52a4-8335-703f8b05512a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:d5cf1987-15da-57be-9f08-601bdb0d294d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:b8ad12e5-6ea8-5508-a611-4ac332270e24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:9908aa4d-ead7-54c9-8720-05da8ccce2f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e5075321-b4f1-59a7-8124-c2bca187982a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:3644a458-ced5-507c-9580-d6174724910d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:4d3a92b2-14c9-532d-81ef-b681c4631eec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging, and is fixed in 4.3.4.RELEASE-tuxcare.6." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:7050f187-9e94-5bde-b265-b9abce43cd43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:84238147-32f1-5cd1-91d3-60f2ed55dea5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:a56acd06-5958-579b-b327-e551e326b380", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c6deee05-3a94-59cf-b15e-27fe62322283", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:254e5002-1113-517f-84e0-57cb381d318d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging. not_affected \u2014 Target version 4.3.4.RELEASE is not affected by CVE-2024-38820. This vulnerability specifically addresses locale-dependent behavior in String.toLowerCase() calls introduced by the CVE-2022-22968 fix. The target version does not have the CVE-2022-22968 fix, therefore it lacks the vulnerable code pattern (toLowerCase() without Locale.ROOT) that CVE-2024-38820 addresses.", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:97b2b1f6-d58c-54c8-82ae-d5a9563cdce7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:512d1c31-55c6-5837-a164-9438fb2ad043", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:39ac7c15-07e6-57e5-b1f5-4b9ce2f467a7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 4.3.4.RELEASE is not affected by CVE-2026-22740. This vulnerability is specific to the reactive WebFlux multipart handling introduced in Spring Framework 5.0+, which does not exist in version 4.3.4. The target uses servlet-based synchronous multipart processing with explicit cleanup in finally blocks, a fundamentally different architecture from the reactive stream-based approac...", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:11faffd9-25a0-53cf-aad1-b1508581ed34", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:b75018fb-888d-5492-961c-36310f576ef8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:8afc076b-bd6e-5cc9-9f0a-5fa5e2fa015e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e6af6bfa-d462-53c5-98db-f11228518515", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:d01f18b1-2526-57a2-aeae-7e1c16303453", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e6a0b7dc-511f-5c2e-9b63-6e6fe47ca345", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging, and is fixed in 4.3.4.RELEASE-tuxcare.6." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1cea447a-cd30-5b1a-9f40-3f2629b3ea2e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.3.4.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:3264c616-119b-5261-99e1-dd7e5ab54664", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging, and is fixed in 4.3.4.RELEASE-tuxcare.6." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:68bd9174-8768-5d8c-b76d-d424f4a82e72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-messaging, and is fixed in 4.3.4.RELEASE-tuxcare.6." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.5" } ] }