{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7e19a0b7-7581-5e9e-bda7-faa8e0bf2670", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6", "version": "4.3.4.RELEASE-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.4.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0b045ada-8dd4-5535-82a4-08064983a63a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e547d226-7d29-506f-acfc-bdcf5fe8f00d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9253023b-c653-52a8-9746-b41ae1dc77b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:fa1a952d-c6d9-535c-b6c6-2e2b46a79133", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e8c8318c-0734-50e3-bc30-f375247d6d9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ab03a4d0-be87-5e48-8243-878d43cd09c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:2209aa85-a1e5-57ad-9afa-dc1f38fec61a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:92f05ffb-2e04-53c2-8735-11219ce125ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a211649c-5f70-5f73-acad-902e0f6b614b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:2b0acc14-cd42-5d9e-bbfd-102017ea540b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3ab829d0-24d9-55cc-8fa9-82f0ba2d76eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:29950d7f-7125-5a95-bc1a-22506ad5c925", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7d689010-5e0d-510c-8026-86d52f63023e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:02a28913-0871-5606-8fcf-600846c17cae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:90126162-0b70-5d70-a9ba-d84fe94ddc79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:fb985991-d66a-5a32-ad94-0305d6ea3844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:8ef2974f-d3b6-58ea-8c83-a7d3d4b7b591", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7ff8d8b6-5a3d-5c70-ab3f-71c4e4e852a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9eadf033-d2cb-53d4-876d-3a39c033c255", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b4b85e2a-e21e-5555-8e31-cc0ceb675c66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e619c0b8-1f4f-54c2-bc8b-53064ffa68ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0bb8724c-1786-532c-9afc-01c70b71c29c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a6606abb-5af5-58ff-b2c4-ef4724179d77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a0f1219f-c571-5da2-8f2b-a3eedf95d2a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:be369cc5-4d0c-5dae-a0d7-08427248c418", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b78a6f24-69b6-52c8-a7ae-98b50a054650", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:08f589c1-5973-55f5-b11b-3228f7dfd3ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:25e769fb-2a2a-50a1-a795-c71833da1f45", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging. not_affected \u2014 Target version 4.3.4.RELEASE is not affected by CVE-2024-38820. This vulnerability specifically addresses locale-dependent behavior in String.toLowerCase() calls introduced by the CVE-2022-22968 fix. The target version does not have the CVE-2022-22968 fix, therefore it lacks the vulnerable code pattern (toLowerCase() without Locale.ROOT) that CVE-2024-38820 addresses.", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:41a87b22-a7d5-5911-b5b0-8f4aec8e1581", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:88438287-2695-50f8-ad65-372f13b3d86b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:802e45b9-2c6c-5e41-8f0d-899587805dcf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 4.3.4.RELEASE is not affected by CVE-2026-22740. This vulnerability is specific to the reactive WebFlux multipart handling introduced in Spring Framework 5.0+, which does not exist in version 4.3.4. The target uses servlet-based synchronous multipart processing with explicit cleanup in finally blocks, a fundamentally different architecture from the reactive stream-based approac...", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:799854e4-ba30-5fe0-913d-32959dff4c6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:8d3f692a-b067-5f22-b08a-451b8f809649", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0635524f-88d1-593a-83ce-c7d3ec235eab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e35be986-03cd-509c-b040-39b7fcc566db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:561c33bb-87a6-590f-9183-c79e7df58568", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b8a4b971-fdcf-5d59-a93c-b94254de1b4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:69b0a474-bade-5669-9d92-b8ed8299cde3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.3.4.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0f7d7fd1-c593-5097-a4a5-c836f8ee5f4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:38cb8aac-92c6-58d4-8507-d4a6b905519e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE-tuxcare.6" } ] }