{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:19529893-6a6d-56a7-8d8a-dc9a06d558d0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6", "version": "6.1.15-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@6.1.15", "type": "library", "group": "org.springframework", "version": "6.1.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b3c3203c-edcf-51eb-96a4-a0ed9ecff4be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:68dc1203-6d76-56df-9809-fca05f0b96c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:2ff947ab-0c71-5498-a2ea-7f80840bcc58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:42d50082-5e10-5ef1-a02e-7acba4960ed4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:a90ee819-2ec0-555e-9c7e-94a622934a6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c69385ed-54fb-5baa-9414-83e650a43355", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:89d1ec40-2a59-5d75-8248-18c64f366a54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:0a2f53f3-87e9-562e-92c3-85c19412877f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:d8b9ff1b-ff67-5c35-a05c-b076f313fcc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:42d7b22c-d3b4-5272-8ee1-068cbaffd849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:d646e89d-c07c-5144-be45-f67b22080380", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:7c29ac25-aced-5e04-9f28-7795a4d3bf0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:0a082cc1-6d8d-5fdf-885d-bfa8fac2e454", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:f65bc287-9b46-5e93-b2da-c3508242f77f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:6220de9d-2427-55a4-b1c0-0e8435ccf7d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:3a39e1cd-56f8-58aa-a4de-8eae8c783f5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:9cc520aa-2d9d-53d4-868b-c87356401657", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e693253d-ae28-5391-b77a-aa6c49f3aa07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c5988b2f-a23e-5f9f-85c8-3b6df4c3fe06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:30918ec4-b33c-5bea-8ba8-6bff8d6911f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:49c73456-b8c0-5eb9-9bfc-4f6bae8f9711", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:4bf9caeb-ad5e-5fc1-9ca3-50aed9fdf3b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b5a5df91-2a25-527a-9042-c4e454f1b709", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:dacfb05d-2fda-5dd2-9641-c37091fe832e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:cbe95e23-b1fd-5870-8e1f-fad35fbbc594", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c48da3dc-86f0-5310-a42b-a742062dd9fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b9d06f31-d265-57f2-9793-0683c5eb2bbc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:d99f2506-706f-5742-8eb4-3d318f53297f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:cfe32bb5-057d-5bcc-90a5-cf9f000f841a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:24f87c58-10d2-5f63-88ab-fa34f19e1306", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:689e98dc-fbfc-5e77-a64d-417527290e2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:f8ccd35c-68e9-5e48-885b-70970f1de541", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-messaging. Spring Framework 6.1.15 is not affected by CVE-2026-47890 (SSE view fragment stream corruption). The vulnerability exists only in versions 6.2.0+ where the Fragment rendering feature was introduced. Version 6.1.15 lacks the entire Fragment/FragmentsRendering API and associated SSE view rendering code, making it impossible for the vulnerable code path to exist. Git history confirms Fragment support was added between v6.1.15 and v6.2.0.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:87952d82-d808-5ca2-88ba-eb4c5f37fe9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:2ab3b6e2-f76d-52ce-b9f2-8a6551598b0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:49a0f190-1d28-5a89-8389-9d2f1a756c6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:f2d043d5-d275-5bcc-9a9b-79d32c7bc806", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b3d1da97-df1d-5df9-b6e6-fb9a6fc60d7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:bcac75bd-bc22-5636-bb5a-2a86668caf89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:1e6eeb86-acf4-59c2-a34a-9f442f3fb98b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:f59cbb33-215f-5b56-955c-c1c83b6e3968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:ec190522-405a-57be-8b8b-9870236201d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6" } ] }