{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:392ca766-1a37-5c55-b463-a579f68c8ba9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3", "version": "5.3.32-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@5.3.32", "type": "library", "group": "org.springframework", "version": "5.3.32" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:2760f62c-4505-5ca5-a29a-ade4fda1be52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:200fe1e0-93ed-546d-9b83-c4b73ed225ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:96322e5f-ab7c-5be1-991c-4d84dc7e1d52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:19ab33c2-5b5c-5c1e-b685-5b134298a196", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:7c650df1-c3f0-5850-b16c-61ec5d2bfa4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:480d90da-a242-53b1-a82e-78318fad7bcd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:a025d62c-d524-5c19-a8bb-01cfceae7c7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:9d48c673-9d67-57c4-833b-ec7127c88dec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:04dd3d79-7901-5e2b-9404-3067397e83b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:4b265273-d8d9-5603-8b85-e002a4cd357d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-messaging. not_affected \u2014 The target Spring Framework 5.3.32 is NOT affected by CVE-2018-1257 (STOMP selector ReDoS vulnerability). The upstream vendor fix was already present in the 5.3.32 release that TuxCare onboarded. The fix adds a null-check guard around selector expression parsing in DefaultSubscriptionRegistry.getSelectorExpression() (lines 162-164), allowing the selector feature to be disabled entirely by setti...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:e062f663-6b73-56b0-90e2-85f9b4ef5c02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:04f82719-9bce-5a17-9245-43cde9bf89b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:366f5ccf-d33e-514b-8dd0-92ac632024fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:13490ede-8e11-56d7-acf6-8a70d807009d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:6b176734-3442-524b-9d2c-4536d9b32c6b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:7a550efd-a6f3-5124-bc7d-e4f922ba3aea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:92efc179-f70e-5d9e-a3b2-bd0886adcba0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:89891c72-98c1-53f3-9b92-fdb73c2afcd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:ba7bcd23-ba60-580f-91a4-be76f4cd8361", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-messaging. Spring Framework 5.3.32 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:bc82c962-908c-5a5e-aad3-222869737f23", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22970 fix was already present in the upstream Spring Framework 5.3.32 release. The vulnerability affects applications handling file uploads with data binding to MultipartFile/Part fields, allowing DoS through repeated access to expensive read-only property getters. The fix (commit 83186b689f, May 2022) filters AutoCloseable, ClassLoader, and ProtectionDomain read-only properties during...", "justification": "code_not_present" } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:1639281b-55b5-5849-8dba-6ca4506acc0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:ed6c7a90-33b6-519e-b265-330dad16e2e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:5eb73bb9-80b5-563d-9e73-fc5dfb8c188d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:9ed6efb5-0422-5bc4-82cc-5eeaedcbd86d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:5831a2a7-a183-5166-b0e6-86fc2c02b98f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:1021c1d9-4abf-5382-9584-5da8f5b676d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3" } ] }