{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4c57bb9a-713b-51b7-b00f-f6659d26ad40", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10", "version": "6.0.16-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b1dfb54d-ba2c-5a58-b5d8-87901a726edf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4ad39af8-725d-55a4-b12e-66bda3fe9f90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:71f5a7fc-db92-53bc-b761-59f00e0a7fa3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c9e38e0d-eb65-5ff9-8374-e5386e9ed3e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1bedf372-089a-5f15-b803-4565e768c27c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3e287a45-c178-5aa2-8b91-dba6b84d0d5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:efdb55a9-3e69-564b-9e79-474eebd56d43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d432554f-6ca0-5dc7-924c-9c9be09363f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6b77b5f3-1f79-5e4f-8cf2-d1f773bba487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d6d8b34f-d9ae-5170-a93f-5080597f69a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c397b151-7a60-55f2-9833-fe20bf25080e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ace6b545-2f8c-5697-8585-a6dd89b7a4cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:83eceb94-e68e-5f04-8a09-909527664be2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:68033d37-0364-596e-b3da-1f2d24846990", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f7d0bcfb-0923-52d6-9fe9-c71a34417dfc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f9139ac9-e12a-5b43-ba44-77ca28e96968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4cc81651-59f2-5f03-a47f-a9e0bcda7e22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b4b6b98c-08c3-53b4-a71e-816941e0042f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:20b75165-9cf8-5c48-b2f8-8f245cb17950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:22da5c84-57f3-5f01-a811-9447d7da71c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ca726138-da65-51c8-b040-a87b046e3169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4f0f3601-9192-597a-a3f9-c593f3c14f75", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:649be1f0-195a-5238-9aa2-4f93746f1e36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:0f00c5f9-b704-556b-baf4-b4eadc169940", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f29bef81-b90f-5668-a0d3-5e13c44596f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c7382e9a-e401-5d49-80e9-7421a8fa5192", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9f5647bd-23f3-5a6f-9b27-d9777500967f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ff261b78-451d-5234-85ae-c717ee63550a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:07cda0a2-d0fd-54dd-aeba-c302c9a5af8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ef1334be-5928-59ec-9098-2e9e486cafa1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:56ba72b5-ff66-5608-a8dc-b2b59fa0559b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:87163445-53b3-597d-8de6-34b222979bea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:25e50916-84b5-55cc-9798-1f6b179dcd53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:03996242-1c91-57b0-81f8-40e7422b555f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:11b9833b-5e71-501c-99a6-69d41c0a7770", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:bbab4f81-d5dc-53c9-9d77-c1a2c8e8dc78", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:fd0e6ef6-ae1a-50ac-8691-05367384c38e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:30666616-4f67-5cd7-b751-2da093d7e1c7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-messaging. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:356f2305-7193-5605-b0b7-0085df3b54c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:bfa9b27f-bfe2-5561-89ba-7f280d906ac2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d4a66e5a-f2a5-5718-9b3c-91db55f16567", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e6c66f18-c4d9-5682-af06-cca66497a583", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:5fc35ce1-d3b8-5946-b297-07099168291b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:cd466607-be10-527e-9062-c4b121011f14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e8f233d1-7fc8-58af-8f2b-8cf40669353f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ed466135-2c10-538c-b2d9-b4c212d09b56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:055601d9-1e52-5da0-945b-74721fa2d626", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10" } ] }