{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:88f08896-66a0-53d1-80c5-81804faebe76", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11", "type": "library", "group": "org.springframework", "name": "spring-messaging", "version": "5.3.37-tuxcare.11", "purl": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:a51b34d2-cf65-5697-bfee-959ff1d75554", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:29f4348c-a56e-52f2-b771-c35ffb421db5", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:3b4fe1bd-642d-5316-9292-229d3e60983c", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:38605af3-4d19-5d43-90ba-ca89425bcf81", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:92715a87-1049-550c-9ef0-d081772feca5", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:3c4274cd-d2f8-5352-93ab-dafa19a01251", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:46222a21-76be-5bea-8ade-a5f1ecbe2e8f", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:ebc59f03-b887-55c6-abec-6a308651870a", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:1cc6826e-128e-5aa2-a9f0-3bc969163230", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:00a4c4e6-776c-5b7c-8335-41be7b4966fe", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:3a65c015-23f6-59e3-a63b-ad8a24b70478", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:df61cc82-f447-52b1-bc55-e9ff435a589a", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0814b9f1-4223-5aa7-b4cb-657815b16032", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:3639b127-3aa5-5b1b-9c87-cd54101b1122", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:7061f00c-1167-5dd5-889a-51166416e380", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:8953da64-41ce-5c14-bb02-30a860b27bc9", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:640f9b07-9bda-50e0-bb30-ab51bc2f7224", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:932b627c-c2ac-5295-8071-2216c4077863", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:861b8780-af4f-5639-99ad-af8f515ddb28", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-messaging. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:b7e6c4bc-b97c-54b5-9f97-d7ad83d1cde2", "id": "CVE-2026-41841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e18ba903-c474-5ec3-b339-b43a726a7a39", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:16461abf-0985-5d17-9043-d76e16375f90", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:79b22624-ea9e-5a06-aa3f-cc48fc668031", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:a200e928-3359-5e10-b49b-f162dee94778", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e7913550-3f02-59d8-89af-7736f10d4f04", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:65f3c6c5-ba34-5da9-bd23-06570836a72f", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:b322e661-dea7-522d-8c66-0eb85d50953a", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:fe0226db-914e-5748-b103-12a21163fbae", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-messaging. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:7854e0b7-0e80-5809-8d07-83e16a0dbdc6", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:fe4c9eb8-3924-59e0-a93b-fd4f4ba840db", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:bea6f35f-a6b6-5f40-9e97-39eb85547695", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0a308754-c89f-5bb2-869c-b59cbdf7905e", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f18b1cc9-2ba6-55c2-983f-afb0d3028f4b", "id": "CVE-2026-41854", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0cc79b4c-c85c-5e85-985b-b212ead70e3a", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:9c488a6a-a5b3-5f59-862a-4fa84e515305", "id": "CVE-2026-47884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0804aea1-bac2-5dc1-a9b3-79740dc93645", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:a830f9b0-35b4-5c40-87c7-7c2cfa034313", "id": "CVE-2026-47887", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:2028da66-c60c-5bc9-b2a3-19fa61509cd0", "id": "CVE-2026-47888", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:4a5b33d2-6b97-5791-a3fe-183429768d3c", "id": "CVE-2026-47891", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0060bfad-5404-577c-9ea1-443d44977ca0", "id": "CVE-2026-47892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:05bd0ee8-b247-5508-9e5a-e8bfc5b78b0a", "id": "CVE-2026-47893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:8fc4d03e-2ae5-5162-adc3-d5c69da0c546", "id": "CVE-2026-59280", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f4e65172-9dff-5c74-bc43-308e3177ee82", "id": "CVE-2026-59281", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:5659ef99-0884-5e03-90b9-81e7081389ed", "id": "CVE-2026-59282", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:8d2ae5d2-9a82-583a-a396-adcf37fdb6c5", "id": "CVE-2026-59283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:7bf6c631-bba2-5365-b03f-c4f9094800ba", "id": "CVE-2026-59313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f7c768fe-3ac7-57d9-ba56-bf7fe11c3672", "id": "CVE-2026-59314", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.11" } ] }