{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3f614cfd-5f6a-58f5-9c6e-dfb606e9cfe8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11", "version": "5.3.29-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:47a009f9-ffd6-5f13-b6fd-5cb073fc0ef9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.29-tuxcare.11 of org.springframework:spring-messaging and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:793bef2a-aaa3-521f-8714-3400959a6c2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:aa9cbd5a-7ea5-5480-9f8b-081f224aaf56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6f76a9c4-fd31-5061-a9f2-8a149ff37f45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:71e90a68-f655-5233-b729-7bc5bd66cdd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bbae80d0-f13c-580d-9bed-52ed58332e49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:30122f14-c75c-5b74-bd4d-e9f38527e209", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d1e33c3c-c28a-526d-9dcd-d261a7a2a823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8b139a90-6690-5f82-a3eb-e4e8a564baf2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:36c75591-e132-50df-a6e0-33876baecffb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4a504075-8f9d-55fe-9e74-2cff9e2fd2ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9254e3a5-602a-5727-b45e-fae2987fde70", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-messaging 5.3.29-tuxcare.11." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:3a077fba-5ae9-58d4-83c6-d95c001c072d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:db5d068a-7b30-5957-9669-40f772beffde", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:59a97ab4-4dd4-5093-8865-e7550408d920", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:89fa4c79-e94f-59ca-a1b9-4277eabee409", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:88e2abf2-0890-5568-a6fc-5a36634d71a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7485d475-d7e5-5145-b217-dfd2400c1f19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0158c539-ceaa-5801-b5c5-8ab6298e67ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4778b2e2-6090-5757-b0d4-361bc9b0a710", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8e61b6c5-c9b4-59e1-abb0-3be5bbddc483", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0358a8cc-c452-5735-8601-6fc546e6a4ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:3dd04b84-5374-5237-b6be-528b86223856", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-messaging. already_fixed \u2014 The target repository (Spring Framework 5.3.29-tuxcare.4) already contains the complete fix for CVE-2026-41840. The fix was applied on 2026-05-19 as part of a TuxCare backport for CVE-2026-22740 (commit bc0026ae70c), which addresses the same multipart request DoS vulnerability with identical code changes.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a6e2dafd-bd46-5ffd-9b9f-c6a9447871f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:06221ea4-8480-577b-88ae-9bacdb6ba6d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:39bc3157-3dd1-5205-bdb6-3b2b7e895bac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d2a21e4c-0afb-5a6d-8a58-797d3d4645f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ea742661-ac36-5824-85c7-422f16d98b56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d23effec-eec8-5862-931e-d8dd5c56081b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:496d8d07-a92d-5cf5-a240-5f714962f9cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ef666b9c-2844-5f6a-aada-8180b868dc4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:04cbb175-9c83-5a46-8a29-39ba20272e90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b3b5d4a4-e9f1-546a-a004-4b67ef0f21f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c0dad69e-c4d0-5995-80b5-f5c320880312", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8585a8a6-5715-5590-9825-8dcfdd225ec0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9274e835-246a-52a4-807f-927eab43ec9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:deb940d2-0e38-512e-8317-827ba9bd4a28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b97825df-5f41-5d6e-8eab-0a12c9dc42d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0875d7c2-0abf-5c0e-a653-a4b8f16afadf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6b3a36b2-12c8-5308-8191-1bfdb0b41173", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9efc96ad-3c59-585d-a2fc-22fa74cc0ac7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:eeaf5eaf-d973-5c24-9442-2c54967b29d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:85e40c93-9eaa-5838-99fa-5e97f23c8cda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0be7c139-9381-5d01-a2b0-dffb8a60a7ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b4578b4d-546c-5e62-a772-063c03d6f782", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9ae91abf-253e-5e83-ae63-d5b13fd1fdc8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9790b4e8-6741-57da-9736-b19daa931030", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b7832f37-656c-5b3e-8495-cd96f24e323c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:92830c72-87a2-5415-8237-0e22d42b5c61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:479af817-3538-5f9b-9ad6-d0807a5e379f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e30e9a54-da48-5a1c-84a9-e80d1405d3fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11" } ] }