{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:07ef213b-0fe6-55c2-b540-dd4622c873c2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1", "version": "5.1.13.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE", "type": "library", "group": "org.springframework", "version": "5.1.13.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0a84d8d2-ba72-5fde-943d-4d485dc0cc56", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 5.1.13.RELEASE is not affected by CVE-2009-1190. The vulnerability requires Sun JDK before 1.6 (with algorithmic complexity issues in Pattern.compile), but Spring 5.1.13 requires JDK 8+ as confirmed in documentation and build configuration. The underlying JDK vulnerability was fixed in JDK 1.6 (2006), 14 years before Spring 5.1 was released. While Spring 5.1.13 still contains P...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:113bd289-f933-5b43-b46d-d706a93d4370", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9c484d3b-714e-5fe1-b487-071e3abe7d4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4221e750-79a0-5c85-a4cd-66843d06a93e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2bdfc020-346c-5223-be68-32f234aea3a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:638dff0c-6c5f-5446-aa5d-4b42f63eba1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:94ecffe1-f7dd-53ec-8b7b-c940118c5893", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:94d49279-82d1-5a22-9eed-adfecade28bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cbeba988-b779-57d6-93a2-7453c3346a92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c6180383-6826-5cc3-aae7-b953f1b07298", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6, 4.3.x prior to 4.3.17, and older versions. The target repository is version 5.1.13.RELEASE-tuxcare.1. The fix (commit ff2228fdaf, SPR-16732) was already present in the upstream Spring Framework release 5.1.13.RELEASE before TuxCare onboarded it on 2026-10-25. The fix allows administrators to disable selector expression parsin...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f9eb4e1e-9350-5d47-8e90-88471a596f9c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:30bf94f6-2faa-5ee9-820d-cc54a0d99788", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4e137790-6f50-5289-af25-39dcfdc31791", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a1e849c8-624b-5799-a60c-e5d7f6169c10", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b6e5e72d-8695-5566-9aaf-ff3a33bc5355", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9b87a947-b709-541f-b69f-e64e11cdde98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8f55be95-8575-5a30-8195-a780fd54249c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:818ef8ad-0d1d-5785-bf09-e44417ecd50d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:462180b6-b7e1-5880-9161-59baef271956", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9c94413a-c8bb-502f-a0ea-b88555995eb1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bea9a1b5-2c50-5646-8804-2b38c6b0d5cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9f591b68-b0c0-5a32-a37a-55c22f85330b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:202b7688-9730-5f79-8606-10a24096ec9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b16916a9-c410-580a-9630-839e9a91441f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:81a770d1-4df7-5a39-96ee-5c901949a956", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 5.1.13.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:634b2654-a9cf-5087-94e2-06dddb360a63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1" } ] }