{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8b583116-9c0f-50c2-a6f4-47f7e2b3ce3f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10", "version": "6.0.23-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:a765d7ad-b76f-551a-a526-13d7335cc2d6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 6.0.23 is not affected by CVE-2009-1190. While the code pattern (serializable JdkRegexpMethodPointcut calling Pattern.compile without validation) exists in the codebase, the underlying JDK vulnerability (algorithmic complexity in Pattern.compile) was fixed by Oracle/Sun in JDK 1.6. Spring Framework 6.0.23 requires JDK 17 as its minimum runtime, making it impossible to deploy on...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:3ede3771-222b-5b16-9fc5-1979110760e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.23-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:cd0a1a84-2a51-5c48-926a-a168f066ce48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.23-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:35286d59-15e2-517e-bdb6-cf7aba24dd4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.23-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:1710e091-fe2e-59bb-bb6c-9021b0b13b70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.23-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:14122175-193f-5b28-878f-44c1909955d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.23-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:93fc3b39-15bc-5c02-af30-5058e4232d5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.23-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:bc957d20-ac2e-56c0-9dcf-05b9d675b161", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.23-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:f166ca17-536a-5690-b18d-6d59845c84f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.23-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:95bafb82-6d02-59b6-af22-22e72f3be82e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-messaging. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions with unconditional STOMP selector header parsing vulnerable to ReDoS. The target (6.0.23) contains the upstream fix from commit ff2228fdaf by rstoyanchev@pivotal.io that adds the ability to disable selector parsing via setSelectorHeaderName(null) and guards parsing with a null check. This fix was already present in the upstream Spring Framework 6....", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:cdc974ab-163d-53b5-bdce-1a27907e6c6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.23-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:d63cdcee-5d9c-5e03-a7eb-673ddc375f83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 6.0.23-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:5ad401e1-22eb-5b6f-b09c-1c9b640ad2ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.23-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:6bfc5a3f-b1c9-51bf-9f0b-aa04843c814b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.23-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:e6d36304-9d77-5df0-8087-39d7d6bf3a89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 6.0.23-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:2a896904-face-56b0-9552-0a56f9d11beb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.23-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:18c11973-077e-5b77-bd5b-591d41ec897b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.23-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:8efb5082-533b-5d8e-b50b-083385b5891c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.23-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:dc622c84-350b-50d1-a353-3a24cb03b2ae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-messaging. Spring Framework 6.0.23 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:4125460b-1779-5d54-b0e6-3d428301997b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.0.23. The vulnerability allowed DoS through resource exhaustion when data binding MultipartFile/Part objects, caused by introspection of read-only properties with dangerous types (AutoCloseable, ClassLoader). The upstream fix was already included in the 6.0.23 release, introduced by Juergen Hoeller in commit 83186b689f11f5e6efe7ccc08fdeb92f66f...", "justification": "code_not_present" } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:eb77bb8d-467d-5382-90fa-f4c5f433aa80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 6.0.23-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:d4d521cb-5a07-5d68-8381-4bee0f872501", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.23-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:e0ad1b70-e5c9-52a5-8b4c-6d131c9ee868", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 6.0.23-tuxcare.10 of org.springframework:spring-messaging, and is fixed in 6.0.23-tuxcare.11." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:57142b71-995f-581c-a3c8-284f7e689db0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.0.23-tuxcare.10 of org.springframework:spring-messaging, and is fixed in 6.0.23-tuxcare.11." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:a27cb220-d7f8-58ab-8d34-de5106b0367d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:b31ee12f-123e-5de7-aa5f-084463aaf828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.10" } ] }