{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1002e369-7c38-5d14-85c9-b693aef030cc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6", "version": "6.1.16-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@6.1.16", "type": "library", "group": "org.springframework", "version": "6.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:d09a3da1-38fe-572e-ae3e-02e09cf917f0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 6.1.16 is not affected by CVE-2009-1190. While the code still contains serializable classes (AbstractRegexpMethodPointcut, JdkRegexpMethodPointcut) that deserialize and compile regex patterns without validation, the underlying vulnerability is a specific algorithmic complexity bug in java.util.regex.Pattern.compile that existed only in JDK versions before 1.6. Spring Framework ...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:266bc677-1932-5614-bc70-acc0e2163266", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.16-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:2e291add-b65d-544e-8774-e02c8c41c27c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.16-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:94575f4f-fa4f-545c-aebc-df7ed90a7a26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.16-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:71733041-01c3-519c-b412-4c98b69f9b4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.16-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:4efbad0e-8314-5bbb-be3c-62c31435d05e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.16-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:c892d8b7-177c-58f1-8f02-b69defdc13e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.16-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:1cde8acd-4fd1-5aa5-b988-8e47eb34cbee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.16-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:86f17c6e-bda3-52ae-aaed-bc9dc740afe3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.16-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:75259708-0004-5bd5-9e8a-b9cf8512e99d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-messaging. not_affected \u2014 CVE-2018-1257 describes a DoS vulnerability via malicious Spring EL expressions in STOMP subscription selector headers. The target Spring Framework 6.1.16 has an upstream fix (commit 5bc80fc094 by sam@sambrannen.com, June 2023) that disables the SpEL selector feature by default. The selectorHeaderName field defaults to null, and the getSelectorExpression() method checks for null before attempti...", "justification": "protected_at_runtime" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:2088d558-7c86-5b76-9c54-5f6ebfafe7a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.16-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:ba99e071-ead4-50e4-bd58-7f01703225a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 6.1.16-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:92d03b50-dfe1-5575-8f54-1697ecbd26b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.16-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:248da0c1-3dff-5abf-a604-da3d378dc4e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.16-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:d9853cd6-884b-5c56-8972-69efcbdea1e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 6.1.16-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:5a228fc7-34ec-50af-af2f-4a873a4def32", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.16-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:7bd84b90-c6f3-5a48-9ca9-28a439e458c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.16-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:8dfa52fd-9259-5835-a54a-2552d08ecb66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.16-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:705ac7e2-19f2-5574-ae20-eb6da93763d4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-messaging. Spring Framework 6.1.16 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:975c72b8-b372-572d-b3af-10489299d008", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.1.16-tuxcare.6 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.1.16. The vulnerability allowed DoS attacks through file upload data binding that triggered repeated property introspection of MultipartFile/Part fields, causing resource exhaustion via unclosed InputStreams. The upstream fix (commit 83186b689f by Juergen Hoeller) blocks introspection of read-only properties returning AutoCloseable types (incl...", "justification": "code_not_present" } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:ef1abc6e-f387-518a-adf8-acb41b3f566c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 6.1.16-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:1df2cfb0-3af0-5ab9-aecc-0b53507ef2d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.16-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:73550327-4716-5af4-bcb9-029eb8953eeb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:136b2caa-9cbd-50eb-8915-73eac209afc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:691f85f7-a1dc-5054-8996-f9437f5cb071", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ], "bom-ref": "urn:uuid:ca8d8c44-c402-5d25-90f6-64281fa1474a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.16-tuxcare.6 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.6" } ] }