{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0e5ded04-fb48-5be6-b767-573c6c2663ca", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12", "version": "6.0.23-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f0520361-9276-504e-8c3c-e1172b90002b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:dbdb5480-7e7d-5d03-a38a-0fefc666cf3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:3f136a26-8505-55a7-b0e7-5f339ace53f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:8e4c02d6-d6c5-5141-a560-86bfa8a88044", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:82201a22-c1e1-5de2-b9e5-de7842fb3af8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:55fd204c-bee7-5691-a2a1-994098d02d06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:944f7984-db17-597c-9cdc-820d122b3b45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:44252e21-c066-59dc-af68-78dbf21f5c2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d040353e-dc03-566b-9d00-3104b27d5611", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b3cb39c9-b08a-5ab1-8f16-f76d04f0055e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-messaging. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions with unconditional STOMP selector header parsing vulnerable to ReDoS. The target (6.0.23) contains the upstream fix from commit ff2228fdaf by rstoyanchev@pivotal.io that adds the ability to disable selector parsing via setSelectorHeaderName(null) and guards parsing with a null check. This fix was already present in the upstream Spring Framework 6....", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:5f5b2a90-1b37-5f62-9941-1440527a098e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:4c469735-2e27-5bba-a607-69df6222ad4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:2b15bb4f-851d-5148-91ba-d9036e395d99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:79abf8e8-2cfc-5bd6-a89c-def7fa35eda9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:c76a1664-162a-5b7b-9a85-b40edae5451e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:fe071022-6441-5ac8-9fcb-afdeb5736cb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:4a181f6c-607b-5581-a888-06d0bd180b40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:9e8cdec1-6ddd-5ef9-8c78-8697483ca841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:3389c02e-4812-5dab-b9c7-b6618f28d100", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-messaging. Spring Framework 6.0.23 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:da6c6ea7-9f9d-524b-8d1c-89a54040f00b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.0.23. The vulnerability allowed DoS through resource exhaustion when data binding MultipartFile/Part objects, caused by introspection of read-only properties with dangerous types (AutoCloseable, ClassLoader). The upstream fix was already included in the 6.0.23 release, introduced by Juergen Hoeller in commit 83186b689f11f5e6efe7ccc08fdeb92f66f...", "justification": "code_not_present" } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:271bd727-5664-5ff8-91d6-a68aaed271e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:2344caeb-f29c-50ce-8148-dc0d60c28de1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:848a1604-70a5-5353-8e50-940491bdf643", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:932f4275-b1ae-5499-b8d2-9ed9e33ca81d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:0de34cf7-62d6-5135-9cd2-9736bc1633fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:4558bd9b-0cbe-579c-8cda-78e9ff0a5f13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ] }