{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6c3eaca3-6bfd-5ae5-ad8a-f098bb166cfe", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework", "name": "spring-messaging", "version": "5.1.20.RELEASE-tuxcare.3", "purl": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:532d8cd1-7f2b-54b0-8eac-6509daa902f4", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a112afe3-b38f-5550-9c18-393b7f9daffa", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f1c9cd57-0a9f-59f3-833e-71ac50a22734", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d836ea69-a68e-5048-8699-2f3e4b4bae85", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f63287a5-21a2-5f37-b689-01dcf0fa4145", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0452cb0a-c4ed-5c0b-bafc-c049fb698c06", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b1690cea-48e4-5e8e-b318-6c8485a142ba", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:44042a64-59ff-5e76-b5e6-bbd4639ff059", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:36f28a8a-66e5-5662-bac4-fcd4497b70a7", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:43f26ecf-f623-5136-b06c-6310d92795ca", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:13a9d2f9-e83b-5cba-b778-45dd14792a86", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ec9c4b41-0b98-561d-a3d7-c9dc243b3ec5", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f158e5cb-e13f-56d6-82b3-b08457779ed8", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f6a263b8-8b25-59a9-8b75-b0ed47a2a484", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5b321ccb-2d3e-5430-b129-0a5478320b84", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:9547574f-2ecd-56af-8108-341960b15c6b", "id": "CVE-2024-38809", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-messaging 5.1.20.RELEASE-tuxcare.3." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:76f3c0a0-86de-55cf-a93e-8d5f9cf24093", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:dfd0dfbb-f372-5e8e-9f33-398a5115409b", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e29d5b02-a1dc-5ff7-be57-2ef17974daba", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b9be6820-f50d-59db-8f22-78d1f0cc9ab5", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0d6dc803-846c-518d-8e93-12cc192fcc14", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:baf6f426-c1f0-55ee-a8d2-57ffd0f5bc59", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:70a3caac-684d-50be-b271-7fc699dedb4d", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a8a24d3b-5cd8-5aa8-81f9-e613c1070d39", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2c470cad-e1c3-52f2-83f2-0292550f7c47", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:431b3cb3-942e-576c-9de0-fa1b3015e457", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:109e2aec-354f-5c25-ab55-7dc34417b938", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e083e579-f208-586f-81bf-5abfbeaaba8c", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:2ba582ea-0404-5440-ae87-a4287f19cf66", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ab3b3c25-b6c8-5cc8-882c-283e6fb05d96", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:b1a5e6c1-3882-5ef8-9427-9093d6580433", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:09359be7-8dea-5a8f-9c10-a75945d04211", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4ba54182-90e7-5902-8e2d-aa6e3c709789", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:44a3e321-7a3f-5296-9750-e71f440c0fa2", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:4dc67e9d-bf20-5358-90a5-01e97f752a73", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:d92cd411-b522-5f13-a7d5-f276079635b4", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:e060529a-9bf3-5877-b2e7-3088a20a2534", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:89c0520c-fa9d-59b8-a584-c3c98e9af89b", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:05d70782-b328-5a47-905c-0b9dd5cc4c25", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ed2db30e-3efc-57aa-93c0-f25799af1f4a", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:47128591-992c-5cb8-b93d-b7965dadf290", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:dfb15c42-e789-52e0-89aa-2ecc2b373588", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.1.20.RELEASE-tuxcare.3 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.3" } ] }