{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:38b72db0-9904-5de7-a015-e9f7110a14bb", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1", "version": "4.3.5.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.5.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b00ef374-7de7-5574-973c-a534b4e57085", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:10de1a8e-f449-563f-80fc-96d140a1d4d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c09b3ea4-d608-5708-8cb1-688a969206fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0ea9f164-8086-5cee-8d05-63e746d978ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7da0f15d-d8e7-5240-bfdd-79037db224be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:94207f06-5178-59dd-a7e5-1eaeb5f1f98c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3af8a9e7-8efc-52a0-9be0-e3bf04475fff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3cb745eb-3516-55b2-b6e5-293afe7a3c07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:87478cd1-ac30-5093-b040-1a3bbde31071", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:dfd3b8ae-f451-52bf-a042-f3a450e0fcf2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ef1c5f62-2eb9-5074-9ff3-ec704ae4872c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3c4fd872-7900-53d5-bbfd-519f0f405fb5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5b06f751-59e2-5a4b-ab06-e83edb9aadb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8693f8ff-9f4b-58b3-8b87-9030bc74b6f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:01273b2d-6396-591f-8fe9-00c3df081266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:84fdfd82-13c8-5b72-ae92-2cf4a91f19d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:092eb02a-7148-5d2c-b8a0-18ece30e661b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8909d97b-6274-5b58-a172-88007c3c997f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7da817c1-e9b5-5a3c-b568-b4d89bdc5502", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bf6784fa-35cb-5e83-9e8c-ea44eed7f8b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:13cae1e8-0fc5-5a9e-97be-a344a7a718ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:014bd8de-eb4c-5246-af3a-bf1a25f20629", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ca67e785-bbf8-5435-9a26-a7387ec5b729", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c2cea3f5-f37f-5db9-9d51-bded2caab8f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:11b3cffa-0ded-5535-96af-d0c7421a687f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a62602fa-f723-5c10-a550-66684efc8445", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3688f03b-823d-53f0-9fa5-a6fa859b2c7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4447f7f8-13c7-5d88-a590-777cb953ba64", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 4.3.5.RELEASE is not affected by CVE-2024-38820. This CVE is a vulnerability in the fix for CVE-2022-22968, which introduced locale-dependent toLowerCase() calls in DataBinder's disallowedFields matching. Version 4.3.5.RELEASE does not have the CVE-2022-22968 fix and therefore lacks the toLowerCase() calls entirely. Since CVE-2024-38820 specifically addresses the locale-depende...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:25f1f631-7135-55fb-9635-01fdd33b7947", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bdb902e4-084b-5f15-9fbe-1982aa693b9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:07381ede-213b-5a7a-98a4-7a509fc08974", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 4.3.5.RELEASE is not affected by CVE-2026-22740. This vulnerability affects WebFlux reactive multipart handling introduced in Spring Framework 5.0. Version 4.3.5.RELEASE predates WebFlux entirely and uses servlet-based multipart handling via Apache Commons FileUpload, which has a completely different architecture without the reactive stream buffer cleanup issue described in the...", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:22ad008d-4521-5b26-a235-3b8d6c9c1c21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:585b9a7a-6a59-5a6e-bc67-e83fab1e9c10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e4143248-d0e5-5298-a8c8-9d54334e648d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8195520b-9e68-5fc9-b5ca-896cc07a222f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3edbe226-b01e-5cc8-9ef8-dc69edfdbc8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:32e307dc-a4f2-515a-9ab1-fb9378e3bcb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:35ab4bd0-a499-505a-82a2-ea01716554c5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.3.5.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8707979b-8a4f-5e1d-8d3e-41dc29ac04d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:148e27c0-e0a6-5746-a669-85573bebedf0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE-tuxcare.1" } ] }