{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0d1fcbde-1dea-5bb3-9e05-e9a50cf070fa", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10", "version": "5.3.27-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f2e6f17c-314b-5ed1-b052-48d154e0d038", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.10 of org.springframework:spring-messaging and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ce186520-b3d7-5c2c-a288-8be38cc9a631", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ede0deaa-7cfa-5c1c-b546-ff1d211a512a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ab8dafa2-8fd9-57e1-a0dc-782daedd17bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9db9e0dc-2780-5396-9ce6-6469b80943b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e70229da-26c3-59c3-a780-44d9531c7231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b091f7b6-6a45-58bb-b0e7-fe050f2ee12a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:67215a45-62a3-5d06-a113-18e6836528f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:beeef864-b32a-5a55-8356-49a8d1e97a14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:ab3c1662-6bf2-5313-8faa-6af298e69366", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:4444789d-3214-5018-b690-5f6d07ce03ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0b85c2ea-e8a3-530a-a617-58baa4e274aa", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-messaging 5.3.27-tuxcare.10." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:644e729e-5361-54c7-99f7-a4f9b754ea43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:591db71c-ddc0-5d66-9e44-3f6325bbaad6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:eca2b38a-f172-52a5-a946-fa6fd743cf10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f938e663-257b-5a59-a817-0662186b5f7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:cbd9c6da-dc39-51a1-8c2c-80fee3d0f42a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:49d8ae7f-08df-5a5d-84c3-54294b4db4c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:29f3ae15-989c-5c89-bc6c-a9ad0d366027", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:7a56d091-aba6-5c0c-95f2-02620aada4c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b94e6674-fe50-5802-bc0a-8a5ed79738d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:95ae70c9-192f-504f-add5-e71e7afda6a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3e7e07d0-49f7-52b6-becd-ad8e0b879399", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-messaging. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:25bd152b-6c4e-591a-81da-7ff10007a8a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f4f2182b-8423-5783-8eee-4681ebf5d307", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:16989547-8ffc-51a3-84eb-ecd2b727ca5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9d609a3d-91e8-568a-8a24-b7f85c3e2c16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:8b98e0c8-d316-5c35-998f-8234657b61ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:8a4e5e26-a1b4-5121-b3ed-309fce3f928b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:afaf7c8d-a217-5125-b3d4-c9adec9259f4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-messaging. All 1 patch commits already exist in target branch", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:100d399a-cc14-541a-bc4b-35432fc05e4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:aac90a93-c5a4-554e-9109-9c624e95cf53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b10aa776-45a4-500e-86fd-a8447204b8cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:6b7e1886-c05a-5a44-b217-c46fd184d619", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:068d6aca-ff16-5737-8ced-b22019f99984", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:14dd240d-fed4-5b51-a827-a957d5045223", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:7e02b6d5-2dbe-5d5b-a80f-9c63c1a17beb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:dee0d79f-7ced-5f49-b06b-7dc98f7b5132", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f2f2652d-58e3-5310-8603-64e7a7098378", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0aad3958-c605-5e38-b941-f52b2b839e7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:4aeb59f1-1eaf-51c4-a286-890426308d92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:56507812-6510-5210-9e6d-b16260ffd67d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:8c446090-d17f-5b44-90bb-36fac857cf24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:90c48377-94ae-50a7-9e17-97f5d4df1131", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1d02c154-9b5c-5222-a920-95925cfac92f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:41b947a4-8d56-5216-9a8e-2e0db50dbc1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e3d4a560-1f91-5778-8ebf-7534fbc43ab2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:97a2eb1d-f059-5476-ab06-ba56f8b07cd4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b42b4eeb-a29d-592e-b359-db6990b41e1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a96ef662-b958-5ff8-85a0-e56e7baa3ff6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:717e5912-94f2-5510-911f-ad47d8cf7bb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10" } ] }