{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a8683594-5886-5ca9-95a2-1628035fa614", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "name": "spring-messaging", "version": "5.1.20.RELEASE-tuxcare.1", "purl": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f049fa27-3c52-5867-aab0-d430355e9c82", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c574bd12-8e59-59f6-aa0e-c9f140c69a1b", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9f859856-6a30-527b-bdf6-b03168044412", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ba18c817-d245-584d-9ae7-c41ecb386de6", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b7875997-72c3-5987-8925-2eaa225cae65", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e006b5d4-21d1-5471-9a44-6f4b4e7f2c81", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cfd894ae-e00a-5c53-8fea-d0b805151bb3", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:aacd7c69-d05d-50c6-b554-ae6586414eea", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e045a6ec-b787-5da3-a39b-38870ccfe977", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d64d7185-213d-5ff9-9b43-4ac1a7385a87", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:78f955d3-73cf-5b52-8ea1-349f11970d2a", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5062294d-1eb8-554c-b45a-f85de0586282", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:37ab5cb4-d7b8-5b77-8725-df48252599ad", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e1dfd4d1-fcb0-54e0-aea2-8265a9b59237", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e205d087-b13a-5727-965f-c99e87c4bac0", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c57bbb6d-a23d-5398-b5f2-cabcacd0297f", "id": "CVE-2024-38809", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-messaging 5.1.20.RELEASE-tuxcare.1." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5615c700-cea3-5710-b5e8-67153bb6149f", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:18767825-d55c-5831-b82e-b8f80f3f5730", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9cefc89e-d2d3-5c91-b0d5-4e51fa00df1d", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:015ce2d4-8f41-52d1-afea-670b6196a71f", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bfd2619c-a57c-588d-baca-7a11938261fc", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:795618bf-d3ed-5ca9-af63-55b0a0aa0c9f", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:807a87c3-5332-5425-99df-961473652c42", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9d2f681b-a3c7-56d0-af3a-f5a836b57a27", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:731027fe-e208-575c-9018-d7d25ee0dc80", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:fc7e2ac4-fa6b-53c6-8fcc-a432ceec8503", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:1135c817-ccdd-5732-b1d1-661c9bed3c8a", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e366819c-fa82-5dfa-b8e8-34890dda4517", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ad7ff768-df58-56f8-9faf-745d17b359b7", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4d2836cf-2aa5-5a01-bc89-7504405c030f", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d4b46f64-1dc3-504d-bf10-fca87e8aeec4", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:26d39d40-0cd5-52fd-b967-9ba6e5171b41", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0c6267ac-b1d7-5fa6-a55f-d224156e38dc", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4c6f36c7-3959-5421-ad5d-8d1699dc029c", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:7781d891-7ca4-5a11-ab18-399b1c2f9965", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:ce280ced-88c0-555a-a545-59a131b0714d", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:41f2d975-50c9-545d-a39c-0196a58bcde4", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:42f1dbc3-ede5-5ccf-a42a-2c9241a8a6a4", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e47b3877-0c1f-583d-850c-256d6bc53ce5", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:25d0015c-a94d-5f45-b51c-fbee7056eb93", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8d88c9cd-ca8f-57e9-8122-ce9dc027bfc7", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b1f50697-701c-540b-96e4-ba7141325537", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.1.20.RELEASE-tuxcare.1 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.1" } ] }