{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d50d6230-8b67-5abf-8963-af791d43f3d7", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10", "type": "library", "group": "org.springframework", "name": "spring-messaging", "version": "5.3.37-tuxcare.10", "purl": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:6521f493-735d-54d6-83b3-c0b98a72715a", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:c038591f-4e8b-5771-8dac-d6d58be1c27f", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:078347bf-050c-593c-bfed-dcd6111be35f", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:bd49208d-0252-53a6-b9d5-4f747e971fda", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:a41591da-dd49-5a61-b933-057023ba396e", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:836996ac-90f3-501e-8698-4e571f671454", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:db5109f3-c92e-5de7-a271-16e403426a1d", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:10ff98da-f41e-5f91-9477-1d6941e474cb", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:83eb940c-19c3-5fc2-aba5-d5fc857a0bc3", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:50d0f159-8cbd-535a-b8bf-775dc90d9d9e", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:9c901dc8-8350-51f2-8631-e98fde701f43", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:afeb5d1d-7e92-56c1-b556-4caa9dd059c1", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:132888b2-5781-561e-8c59-8f8931b0ef7b", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:9af64d33-6aaf-5ea8-8e4b-47e83e70c5b9", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:af825f94-85f6-5208-97de-5802056d2b5b", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d41f2e7d-d4b7-5af0-90e2-d3633193abbb", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d294def9-2953-5ad3-a8bd-df47cf984fd2", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:8d5335e9-601f-5ed7-8558-ffff996dfd6d", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:d5e1d9db-3f0d-58be-ab97-90b78a99ecdb", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.10 of org.springframework:spring-messaging. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:7a5af612-45af-5241-a707-9268da421b17", "id": "CVE-2026-41841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:00119281-e0e0-5b91-9b32-d9c75da9c23b", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:35f1d2fb-c883-5024-b15e-3d46889463ec", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:5fc4625f-88b8-5bdf-8d38-73cf2ff79c02", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:6b756ed4-8417-5cb3-b280-78ce2d78dace", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:133819da-2375-5de6-ab61-8fc911b46b2d", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:de2784cf-3f20-50ad-aea1-7b6305bf5659", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:ecb6aa77-6a3d-5b2f-8037-c35d277a5fb1", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:e633b5d5-891f-5664-9c58-fc1dfdb05aac", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.10 of org.springframework:spring-messaging. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:baece541-7417-59aa-8f2b-6ad604961b9c", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:0139f26e-9132-5d4f-8e54-69db9cb4936e", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:41a6a3ea-75d3-58b9-92b5-feba94920c34", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:da03259f-56a8-5ef0-bf4e-205b3936396b", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:aaf281c8-cbd5-51de-a7f4-603677d6a3ca", "id": "CVE-2026-41854", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.10 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:9b5bee0a-fb33-5f16-bbb4-c8d275900f9d", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:f79450b7-07e3-59f1-967d-0b48b9cf0fae", "id": "CVE-2026-47884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:52b9a688-a50d-59e6-9617-19424b780643", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:3c798df4-8ba2-59cb-91cf-2c7b9b14eb07", "id": "CVE-2026-47887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:594ed103-4dff-5d2d-a6a5-959062e582d8", "id": "CVE-2026-47888", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:ead1a3ef-bfd6-508f-91d4-c7c38f02b166", "id": "CVE-2026-47891", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:001063a8-b509-5de1-9f4e-0a6b1ab5dd18", "id": "CVE-2026-47892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:e770ea9a-c8d1-5793-abcf-6a14f3433015", "id": "CVE-2026-47893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:1d8fbe11-76f5-58c7-bf31-f418be6d65ea", "id": "CVE-2026-59280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:c79584d2-3ff6-58a1-9363-4eeba067fa3e", "id": "CVE-2026-59281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:ee752422-92b7-57ab-ad59-ea05c20e7501", "id": "CVE-2026-59282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:29fd0fe1-78f1-5e52-b52d-daaed2671477", "id": "CVE-2026-59283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:2c5d7f2d-a90e-59b0-b36b-1d7c95fc2beb", "id": "CVE-2026-59313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }, { "bom-ref": "urn:uuid:69386ab5-5c87-53db-9c39-eb1b18e8259b", "id": "CVE-2026-59314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.37-tuxcare.10 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.10" } ] }