{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fdb35cb2-ddee-5a45-ae42-cc0e81e9cb31", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5", "version": "4.3.9.RELEASE-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.9.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:6de4d780-9d4a-5b40-b89b-1dfe869ca18b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1a2428c5-dfbe-5b96-8aa0-46ec7d33a5dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:255e7bd1-1534-5cbb-b4ea-0fe96fb3db99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:20643888-447c-5878-9309-b641fd745ee2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:a4f7565a-334f-5ef7-a7d2-079fee727431", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:42b6c059-2fcd-5fc2-8903-e65f790e053a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:65ebe92f-a5d7-5609-a868-ddd587b8928a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e29fb1f7-3bc7-5b07-a96f-024a18340bef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:0421e149-dd89-5058-8ec7-07e95e9d3a79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:d5b8dfba-d21f-5028-bf57-36ced7192a3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:cfeca93a-6cc1-5a38-8dd8-c7664999fb67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:8796ff2f-43cf-5407-802a-74b71d38c77f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:758c3a7d-62fb-5dc8-8c35-e10a2c92c459", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:0e65e9d9-cfbf-50dd-9aa4-bfae40aa8261", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c84b3b4c-37c7-5d83-aba9-f3dd49e22936", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:86ff5eb7-7677-5782-bcf2-e304272ce350", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:b3b2853f-dfbf-547f-93e8-9d7eea8bc58f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:d0674f19-25d9-5f76-b608-2995c0c54272", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c7930c7b-b407-59c5-935e-8643077c71e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:76316c6f-b8e4-58bd-8f04-c577131c682b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:dd90b197-dd55-592b-8ed7-9bae4a3edbaa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:0095f074-4020-558d-ac4c-d3f279dd920f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:18a5cd27-ef4d-5045-9e01-226b71f1a452", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:65035fab-1583-59ff-b1e2-fe181e9910a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:4c04ea32-7952-5ab9-980d-11b3c33386f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:d164da31-3a49-54dd-8205-3be4eb6e62b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:9b502bf9-94bb-55c1-b2b7-f4074f51040d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:4e7dd024-dedf-56a2-bdc9-017ee217d149", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 4.3.9.RELEASE is not affected by CVE-2024-38820. This version does not contain the CVE-2022-22968 fix that introduced locale-dependent toLowerCase() calls in DataBinder's disallowedFields mechanism, so the specific locale-dependent case conversion vulnerability that CVE-2024-38820 addresses is not present. However, 4.3.9 is vulnerable to the predecessor vulnerability CVE-2022-2...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:4eea3fb7-3d89-536e-b6a7-d776a2f3e97b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:0cbff706-ba16-587b-95d6-061585b3ebbb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:dcdf0606-fb48-5c8d-9a36-e19e12994a89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:bed7987e-0316-5fe7-b1da-1512f9059d23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:745405ef-964d-50ec-8818-4f124325ae16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c66f1b1a-a2f1-526c-9ead-2f8bd4897bfd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:588d8e6b-6c40-5602-860f-6871dbe959d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:31fe0dcb-b0b2-56d4-8242-e0e1acbf2bc5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:db7c3abd-7c64-53f9-8460-e597caf06108", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.3.9.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:bad93d50-4a69-58f9-abe3-8f03dc5e3c3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:168f8a92-22e0-53e6-9985-c6b98d0ed3cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE-tuxcare.5" } ] }