{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:023469de-6301-5cc2-adbf-05c5184b84a3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1", "version": "6.2.3-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@6.2.3", "type": "library", "group": "org.springframework", "version": "6.2.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:eee7ac4a-7480-59da-9913-76dafeccc0ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:435e4c02-52cd-56b9-970c-38f5ca9dae61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:aad3f4e9-33cd-5206-9cfb-b7d99fae2ac0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:37245932-8a31-57a9-9968-83680cd8aee0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:5d284d1c-a1ff-5751-a6e3-023e477c2e25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:b5cc60b3-1169-5c42-9ed3-8ed3cca3e5a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:46572696-96ec-5a47-be1a-edcd7c32f919", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:2724da31-5acd-581d-8df6-01af245a571b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:0fbad218-7006-5138-8a0b-363bb0c6614b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:92d021f3-f77b-599d-a6d6-c10f22cd6a93", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-messaging. not_affected \u2014 CVE-2018-1257 does not affect Spring Framework 6.2.3. The vulnerability involved unchecked parsing of attacker-controlled Spring EL expressions from STOMP subscription selector headers, leading to potential DoS through regex/expression complexity. The upstream fix (commit ff2228fdaf, April 2018) added the ability to disable selector header support via setSelectorHeaderName(null). A subsequent h...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:4734a98f-e086-5430-bc9a-0ec6b253d025", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:1c82e149-5a61-56b8-9f0e-7f71f4af5420", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:230ba8cb-88a6-54bb-9ba8-6e3b270f8351", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:1c0565c6-4d14-5f47-a854-2af30bbfab05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:f77a2673-1f21-5805-86e3-4999fde89dda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:9ba3b141-6061-5789-be76-ac5f6346636e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:fc9c704b-e461-5025-95ea-8496cbcf4f80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:f5fcbdd4-ab57-5b81-b8c8-4bbef0a54c8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:0546feec-1453-5e12-a654-0e60ea4acfca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-messaging. Spring Framework 6.2.3 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:4b8cd4f7-96bf-5b6d-b5e9-b2bb6ffe622e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 6.2.3 is not affected by CVE-2022-22970. The vulnerability was fixed in upstream versions 5.3.20+ and 5.2.22+ (released May 2022). Version 6.2.3 is significantly newer and includes the complete fix in the upstream release. The fix filters dangerous read-only properties (AutoCloseable, ClassLoader, ProtectionDomain) and specifically blocks URL.content from JavaBeans introspectio...", "justification": "code_not_present" } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:81bcb607-d469-5dca-80fe-15cb453e65b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:673cb208-f309-5c24-a5a4-63d248be0212", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:d5273460-6cef-5055-b290-35d24e126135", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:3547b76d-7a8c-5f1c-8e79-f929cf17e35f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:efb65cc2-16a6-5d82-8cce-59263ec31556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:02f05681-fee4-548a-acd9-521eacf5fa51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.1" } ] }