{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:92af835b-c6c3-5ec3-a436-be3214560396", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7", "version": "6.1.4-tuxcare.7", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@6.1.4", "type": "library", "group": "org.springframework", "version": "6.1.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:a261d331-9917-50ac-9133-2340f20f2727", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.1.4-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:3a140325-0c9d-54fa-9618-e25db042b28a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.4-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:6775a876-2837-576b-aaa7-ebf78d89b08a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.4-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:403f6f37-1318-5c52-b9da-37a4a94241d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.4-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:b5781c2e-512c-53f1-985a-2c2fca9d2d3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.4-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:b713fab5-03c5-56a7-ab6f-4551623978be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.4-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:09ccb2db-6f22-5af5-aea7-424876252f3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.4-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:85f7a2ba-d1b6-5094-8507-c77536de6a9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.4-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:f046ad9b-f6b0-5e75-8226-b2b18a6a8e35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.4-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:a59928bd-bdff-56cc-8569-a3e78554c863", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2018-1257. The vulnerability (DoS via malicious STOMP selector header causing regex/expression parsing exhaustion) was fixed in upstream Spring Framework 4.3.17 and 5.0.6 (April 2018). The fix - a null-check that skips selector expression parsing when the feature is disabled - is present in version 6.1.4. Additionally, as of Spring Framework 6.1, th...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:82bb8d2e-7893-59a0-9dc1-56be63c1664d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.4-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:ebace81e-4a9c-5cd2-8e4a-07235ecdbde2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 6.1.4-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:6f0002b4-cdde-513f-bdc2-cc774cdd4dee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.4-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:8d818dbd-187b-5c52-ab8d-1d90766a9f76", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.4-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:aeaad1af-078c-5655-a70b-891d4977e459", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 6.1.4-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:510b085d-0257-58f5-8b3b-4ef0da5f043f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.4-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:282c346d-38b6-558d-a586-3688d1f3d1dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.4-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:86da95dc-5362-515c-8c5d-18ffb82f58ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.4-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:71ad8945-b796-54b9-863f-77ac1c969ec4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-messaging. Spring Framework 6.1.4 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:677be3f6-6026-5025-9c64-0895d01dde1f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2022-22970. The fix was already present in the upstream Spring Framework 6.1.4 release that TuxCare onboarded. The vulnerability (DoS via data binding to dangerous read-only properties like AutoCloseable types and URL.content) was addressed in upstream commit 83186b689f11f5e6efe7ccc08fdeb92f66fcd583 by Juergen Hoeller on May 11, 2022, well before ve...", "justification": "code_not_present" } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:278e0dbf-a638-52c0-a442-50bbcc558f4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 6.1.4-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:4342f03a-b436-54e8-b32c-f8101c4d7e6d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.4-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:88f0e629-6de3-5bad-addf-7b19e82d1c3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:037f461f-3d33-5776-ab46-3afc8d407185", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.1.4-tuxcare.7 of org.springframework:spring-messaging, and is fixed in 6.1.4-tuxcare.8." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:47cb686c-7c6a-5f89-8bce-03dbb73c118a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:ee6a7b2a-2278-5c38-9680-f3d418f039eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.7" } ] }