{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a9165f9e-d290-5a48-a156-2e407fa3e0a2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1", "version": "5.0.0.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE", "type": "library", "group": "org.springframework", "version": "5.0.0.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5b6d32b4-91b9-52eb-a19e-858b745a7eb2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging. not_affected \u2014 CVE-2009-1190 exploits an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in Sun JDK before 1.6. Spring Framework 5.0.0.RELEASE requires JDK 8 to run (sourceCompatibility = 1.8, per build.gradle lines 114-115, and README documentation). JDK 1.6 (released 2006) fixed the Pattern.compile algorithmic complexity issue, and JDK 8 (2014) is well beyond that threshold. While Sp...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a6a96962-9c8f-5ba4-89cd-0aa5f3bb2719", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4e33a42b-4b60-59de-b4e0-72e5f3fcec72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7d2d798b-0d55-58c0-9a04-5e38e1d204b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fcadeb8c-6787-5f0c-87ea-cce11060308c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:87bbe00a-1e0b-500b-9746-40c43a8af6fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3d3fd544-94f2-5b85-814d-cb87e545b229", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5655171a-09a1-5b04-8a57-1acd4218f327", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4e4c7f78-5dea-5a83-9d12-504ea5dc8261", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c96b874a-3144-5846-898b-d4e42c04b7d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f124c81e-7706-59ac-97bd-0a2f4bc8d8da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b7175065-79c8-5d40-af0d-08e2af3a3862", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a0e808a5-b2a5-5395-8559-34101c5aaf41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0ec6ad79-7f58-554c-a555-05eca3d1d8c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6974d3dc-2f0c-5b20-a1df-fe647e7f99b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e197e2f5-daec-54a7-b45c-592668a1e4cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:713771dc-b68c-5f20-a6bc-e3b767c615e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:710af165-9715-5857-b41c-2736e07da1b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:efd3a5c4-4b02-5cd2-8de1-8f27a0ec9ebd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4558d4cb-f91d-5c3f-b6e4-6088f79256df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7bef23e5-0cc3-5c0e-bf4d-98d8bcd2e536", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8bb14a53-0423-5bfd-a323-48cd7f147b18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c0653a1b-0db1-555d-9c69-26a200081c6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:17395eb0-6782-5a94-8587-663b499c39ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:627a8a9a-37fc-5581-bc72-47cbeb023934", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 5.0.0.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0d02787c-a12c-53f4-86d2-e7b01e715d52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE-tuxcare.1" } ] }