{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7c520270-8749-5528-88cd-565488cae7b9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3", "version": "6.2.3-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@6.2.3", "type": "library", "group": "org.springframework", "version": "6.2.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:0b492175-be5f-5ef9-998a-3fd359b558fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:3e457ce4-c0e8-57fb-b01c-86e625c9e714", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:6ba8a415-6617-550f-92d3-c1b07928b876", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:25e36e61-bc28-59e4-a4d7-b4d6bcdc96a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:a53afb37-aad9-5166-a65e-1efda848d462", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:43176d9d-d732-5a57-9315-3ddb3203d04b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:d61c4338-4c81-508b-bf7e-49927d004534", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:23713236-ae63-51dc-836c-5c662709bf88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:42a0c869-deab-51b4-aa37-48dfe756a49e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:6cf58856-757e-5e7a-9471-02aa85792b1c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.2.3-tuxcare.3 of org.springframework:spring-messaging. not_affected \u2014 CVE-2018-1257 does not affect Spring Framework 6.2.3. The vulnerability involved unchecked parsing of attacker-controlled Spring EL expressions from STOMP subscription selector headers, leading to potential DoS through regex/expression complexity. The upstream fix (commit ff2228fdaf, April 2018) added the ability to disable selector header support via setSelectorHeaderName(null). A subsequent h...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:6a323be3-7ca4-541f-be12-57ce1e328788", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:3170832e-46b1-5494-b607-1386e891e341", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:e300a77d-4d55-5865-a8b0-3ff3a88f7a5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:9422ac8d-aea5-52cd-9d8f-62c981ff4b4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:8dd7c66d-dbb4-59b9-b740-beebe1448f74", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:3d458ad5-d7d1-51b3-ac1a-68b691c2ff6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:a8b4beb3-300e-5dc1-9075-89cbc2fac2ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:6958b189-2e4e-51ef-bed6-3b23a47cfa9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:f8735117-5360-531d-b337-545b827c0a2d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.3-tuxcare.3 of org.springframework:spring-messaging. Spring Framework 6.2.3 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:f2e66bf2-c621-5899-8147-20eb7d4aca28", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.2.3-tuxcare.3 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 6.2.3 is not affected by CVE-2022-22970. The vulnerability was fixed in upstream versions 5.3.20+ and 5.2.22+ (released May 2022). Version 6.2.3 is significantly newer and includes the complete fix in the upstream release. The fix filters dangerous read-only properties (AutoCloseable, ClassLoader, ProtectionDomain) and specifically blocks URL.content from JavaBeans introspectio...", "justification": "code_not_present" } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:e48b1834-0027-5bdd-b393-451f042c42cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:3aca22a0-7a05-5969-a549-0992f1eb22af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:d4afecec-3e9e-5d89-88d1-1a7683ffec09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:e5acea87-5f24-5c4b-a7a7-f009851893dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:7061ba17-29a1-5cee-9a44-40984d52c12d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ], "bom-ref": "urn:uuid:e0c6b252-bf52-5bcd-b087-3d317a75a0cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.2.3-tuxcare.3 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.3" } ] }