{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:919f3730-707b-551a-960f-89bda9badf03", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12", "version": "6.0.23-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ce3087de-9a3b-5214-b840-e43aabae4413", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:4eb0b0e2-db92-5825-9939-5e4e849135bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:573ae409-df7d-58a5-845f-7e7843b69299", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:c9efb1aa-7ca5-537f-a6f8-bc500d41318e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:328d10c2-52dc-54f6-913e-9272b337f5eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:5c65f733-e876-5136-bc54-f4ddf695adb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:848a1604-70a5-5353-8e50-940491bdf643", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:73e5a5a3-e719-5ef4-94b0-1aeaf7d50ed9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:e36c6c96-22fb-50df-9918-2c402e0c0863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:7fe690c4-4769-5be2-9b72-fb744040cfcf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:6c0820e3-b3df-5421-a2a5-460305aefccc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:c7161d95-34a0-54b8-966f-3090b2903131", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:a8d5b5ba-efa1-52e6-9e7e-1e99e79b8676", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:7ee31202-8abe-5923-9a64-5679b1813654", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:e74c0384-1f56-5f77-8d68-e6a3d3f4e9d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:4734f8aa-2be1-5e68-aea1-3444e4ca76f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:6546c842-ee26-5e7b-a521-04747c6980f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:9a5a50ee-23fb-5e22-861d-139c00ce7d8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f8b5be71-7e87-5139-ac47-3113d8195ec0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:61e7b833-1775-517b-8853-9789e8cbb497", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:3b7cad77-45ec-5c35-b552-6919b1d9e68f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:dbfa6359-297e-5f6e-b5c0-4821bb57fc88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:932f4275-b1ae-5499-b8d2-9ed9e33ca81d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:970b3f0a-6468-56cb-8812-4428a6716ec9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:c5d29e3d-6a6d-5ea1-99e9-0bc17feaa94d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f05c5409-7727-535b-9968-979b3ef11d7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:58d0ed0f-1229-51a6-985a-44837c6121b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:af9e08b0-e533-5bc1-8e07-27fd0f425b44", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:78b234cb-ceac-5767-b9b5-0fc350798589", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:72e5fbc5-39c0-5b9a-9179-37dd9cd029eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:521eb997-9d4c-5223-87cc-3ebbd4420813", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:db22fdb9-8b54-5ea5-af29-29075c54bc6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:0de34cf7-62d6-5135-9cd2-9736bc1633fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:a2df8781-7943-5d7b-82c7-3999da491703", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-messaging. Spring Framework 6.0.23 is not affected by CVE-2026-47890. The vulnerability is specific to the Fragment rendering feature for Server-Sent Events, which was introduced in Spring Framework 6.2.0 (commit 622c1b9e8c, August 2024). This feature does not exist in version 6.0.23, therefore the vulnerable code pattern cannot be present.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:00c032f4-21b6-5a66-9d03-10bb694b856d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:57e3af3d-1d04-5a3b-84aa-33a2da46c0e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f406f679-a004-5770-9ed6-3f90f42a9d0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:347a2675-4346-588d-b25f-08edfd08f469", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:93e24e2a-c050-5049-a527-406d821a603c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:4558bd9b-0cbe-579c-8cda-78e9ff0a5f13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ddb76c2b-2392-5eb6-942f-e00cb78ef16e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f2848fca-2777-5dcd-ab85-01bb495bea9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:2b3b772e-8420-5804-9d67-993924bba5eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.12" } ] }