{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b80e022e-dbaa-5ac4-a458-f652a7f7db69", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11", "version": "6.0.23-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:b77f7c67-64fb-5de6-bdb1-f7723f363f0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:62acbe8a-2bf7-5747-b138-7819d8e8a6da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:94c25667-c3bc-5f82-ae2b-6129f138a2f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ebd918b0-cf64-5560-9885-75b45eb81ac7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:5e5ab880-ecfe-589f-8cf3-691c4f6fe801", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:defb686a-ef3a-5b8f-931d-8d1159a00d20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:4b6d8260-685d-578f-823b-7ab26ac7ab91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:709b8b09-a344-584b-9af2-7a6ce2afac0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:1940b1cd-2d54-5b8f-a6bf-966fe6c59f0a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:73cd5f5e-e2ce-5e30-876e-170795a6611c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:131a0db8-457f-520a-a766-57d7ad18f800", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:fe9a41dc-2271-5aef-a8f7-79846080d267", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:e3d9ecb0-aa8b-5145-866c-eaf8c39ac789", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:21599022-4955-55ab-aa14-07b12a59d1f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:32640cde-c7b4-5d9c-99f1-52f86ee5b72d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:5b6a863b-51af-5e4d-b22c-057d7a867fee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:8da2529c-9ca6-55ca-9614-7811c5fa1bcb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ba937faf-3128-553b-8c4e-6ab033fd91c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:5c17edad-e2e4-52df-a13c-a225fc7fcf90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:6adbc6d1-f96d-50c1-834a-47141117e110", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:4b6c8723-09b6-558e-a44d-bd543f10867b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:7d683fca-9bae-54c2-981f-a685be8f9e76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:077acab3-c374-5d0a-ac93-dee1aa4f2f85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:da5503c1-c1c4-59ac-bfb0-d9f6f8a7b349", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:b336a0fc-44e0-5443-93a5-cf33fb5d39f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:f3d0746e-1682-59d2-9bab-fb8ef6396528", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:eea8cb33-1548-5329-801c-0bc9e42257d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:0824e715-4d3e-506a-8a8a-365203b6932a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:c8cb925c-8ec6-54b4-a431-10d1cffee9e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:4da7093e-129a-5142-857b-96e2982d2e50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:8a4760cf-c83d-5ece-9142-edf78166fca9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ddf22c98-4fbe-5b5b-b7ec-72105468913f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:e914d098-cff2-5406-840c-e7b9a98df9e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:b60213ef-8309-51c7-9196-aa3faef11d15", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-messaging. Spring Framework 6.0.23 is not affected by CVE-2026-47890. The vulnerability is specific to the Fragment rendering feature for Server-Sent Events, which was introduced in Spring Framework 6.2.0 (commit 622c1b9e8c, August 2024). This feature does not exist in version 6.0.23, therefore the vulnerable code pattern cannot be present.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:9f99ea56-cfd8-57f7-8481-ad11638404e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:7ad09716-b610-5aa2-a273-50baf1953b71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:7e8989d1-b7e0-531e-bf90-50a0734d1933", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:2b723090-ffcc-58c8-b6c5-3f9e990bbd53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:c1e94408-2d91-5e27-aa4d-a3cc6fc1c68f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:1e01daab-8be9-591a-b976-d282e2ec1c78", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:fefb5d1b-6030-5b93-8970-8bf23c6822f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:3edbe6dd-8b5a-5a8a-9b7f-a3aa07f08e0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:75406fd6-be9a-5f82-b3af-2cd5c3e6f4f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11" } ] }