{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c298dc99-de8b-5815-9fd4-ce8568b85bb2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10", "version": "4.3.30.RELEASE-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.30.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:b06d308f-9609-5394-b3aa-2752fa93c7af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:9d77f0bf-85e6-5d31-981f-3d37cd85a41e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging. CVE-2020-5397 doesn't affect spring-framework 4.3.30.RELEASE", "justification": "code_not_present" } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:5cb641d3-28b2-5ce6-84ca-4c4380ffa443", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging. Version 4.3.30.RELEASE is not affected by CVE-2020-5421: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 6327c60912cd80120040c8c16c3731d8bf6c19f6\". No backport needed." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:f72ec8d7-85e4-5417-acd4-6c0f585fb3d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:470913b7-ab8b-5609-ac88-dcc16bdfd708", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:8de1d742-b7c7-528f-82b0-edd0189e8ba8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging. Version 4.3.30.RELEASE is not vulnerable. Summary: Target repository is Spring Framework 4.3.30.RELEASE-tuxcare.2, which predates the introduction of WebFlux. The vulnerable code (reactive multipart handling with predictable temp directories) does not exist in this version. CVE-2021-22118 specifically affects WebFlux applications in Spring Framework 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. WebFlux was introduced in Spring Framework 5.0, and the vulnerable multipart han [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:53ecb5ca-7b6d-5afd-a3f6-d04021e08b24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:6dfcc653-b51d-51c6-a428-9cd78f866d93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:d95559be-fdf8-51aa-967b-288f5a2b5981", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:ee3e20ff-45d4-5d63-a2c2-54484262ade3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:2a24c648-8464-53db-b21d-19940447879c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:f2beb535-66b5-517e-8a05-ad66eeffe260", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:6a12f967-6e88-5886-9d57-8fdaf4062d90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:ca33bcb6-5fdf-5ddd-a402-0ba20cec424d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:f5356233-88fe-54e8-9fcf-2dcda659d345", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:6c2bea45-ff8a-5c81-b1db-35802a5ea545", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:fe399961-d868-5780-86a0-5d16aba1dcd4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:59fe6611-f01d-5e1d-be52-bc994cbc5e82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:0ab80335-14aa-5d11-b9dc-e5389054c824", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:99c9ef8d-3d00-516b-91fd-746a5599fe0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:11a4821b-1e53-5dd3-8207-da4c0c23a544", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:93a21056-a63f-5efa-94b4-6759610f67f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:aa0b0068-82d9-5340-bbba-ae1c3fa97e81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:3624b772-97c1-5dde-bc3c-32923b6206bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:89e9f49e-4d7d-5f57-a7a1-bb2711648c8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:f5f65f25-b9a1-58da-b00d-71c349016103", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:a87f5273-1dd0-519c-9c47-3d0ef7cbd9fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:20399045-1c09-5db9-9714-ebd39fe9dde1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 4.3.30.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 4.x is not in the affected range.", "justification": "code_not_present" } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:058ef7d9-e9d4-5112-b42d-c157e55a8207", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:7797897f-cc5b-5e06-a593-6d37f2976905", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:416d82bd-b24a-5b99-9de1-45e38ecfab3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:36fa419c-922c-5a08-8574-cc1b39894bdb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:829059b8-159f-59e0-95b6-cc4fecf25330", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:ea2864d2-72f3-515d-971f-e369cd66d0cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:cc1ed136-740b-51c8-bce7-d17b54b84f94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:b07e2985-c1cb-50d6-8325-7278d8ecdc39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:246874f7-4cb5-52c1-9789-6b5d5ee53f09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:1905a362-3244-5233-8a69-0b46cef823c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:d8ec25f3-24f2-5b5e-a4ed-16abd3765131", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:bbd2a4e1-8c43-5102-931a-34382a8294f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:de2799dd-aa71-58e3-adb6-550341801524", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:d67c4e21-6908-5e75-9e2d-6b344391a478", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:82c48fc2-c195-541f-a0c4-23e1371c4345", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 4.3.30 is not affected by CVE-2026-41853. This version predates Spring WebFlux (introduced in 5.0) and lacks the vulnerable component DefaultServerWebExchange.java. The vulnerability mechanism - Spring Framework's message reader selection based on wildcard Content-Type headers - does not exist in this servlet-based Spring MVC architecture.", "justification": "code_not_present" } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:5d014086-d3c9-5182-8bc9-6f74ac983fbe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:c7ef3265-61ea-54dd-a7ac-c59420eac08f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:23897002-737a-5ff7-9818-af18b1b6359b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:248ef0fc-d012-5c09-b8f6-a5eebffee796", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:e2355eb9-bda4-5c49-a399-ad1741a37b9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:53c6f7b2-64eb-5777-9b9a-236fc31c1616", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:045ae957-a988-56cc-b3c2-9bf949bf0022", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:d7f084c0-217c-5e87-a7b3-c8dcedebcc68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:1171a7e5-9616-5c73-8a0f-f76c5f48deb6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:06f81c65-7750-5179-9e57-2fc916ce0c02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.10" } ] }