{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:19048ef2-d898-5171-9b43-036f179de10c", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "name": "spring-messaging", "version": "5.2.13.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:1913ac2b-782e-52d8-9465-98517c8ab8cb", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:61cf2c54-4758-512c-9f43-76fd2a12d948", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4766d6d4-3755-586c-8aa3-7e27085d8273", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a6eab1b4-65a3-5841-a055-40d99047af7a", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e056f41f-ed61-5364-9260-6e5e8ec9cb51", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:46580e0b-dd20-56e3-98fa-3ac8330c459f", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:074796be-2e09-563a-a194-15c4e46ae21b", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:aa909604-db15-54e5-aa2f-4bbbc15b8b23", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9e2275df-799c-580e-a1e2-b9d61c3849ea", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7c811b99-ead2-596a-b386-9758c44a61f6", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:43bb7db8-1ae3-5cd1-a450-f7c9d564f089", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:13bc83ec-f296-5c79-b405-6a84923b6c19", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c3da91e0-a801-518a-8a6e-f5b7a29004d8", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:27c25d98-2fa0-57d8-a11f-6347fae3caa4", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a0a6a90c-3753-5df4-ad0f-5d158db372ca", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ba38e30f-962f-5f52-a63a-c90d23e5d6e1", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:96b4c5cf-ee05-5135-88bd-fc674f55e726", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c006bdbf-4770-58fd-9a1d-24d1e5393d8e", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9fd85fd9-ea8b-5518-b357-1d42c9e02d7a", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:10432fff-d5ff-5ed2-8ffa-603422599e04", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a41f177f-5304-5677-bfc3-9fe38b1df82b", "id": "CVE-2025-41234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:da26652f-8ff2-50a8-b764-6ef9eba6bd83", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b6495447-4b82-5a0b-ac29-900bd1a5dcea", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:77569317-58ef-5d13-902e-7be7431cfb36", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:38c74aa6-1166-5ae1-b131-366ededeaa01", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1ab905e1-31a4-5546-b3a8-b7a3da45aaed", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:43dfc2c5-90ce-509c-bc63-adc57f3026f2", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:091d26e8-efa0-5d95-a3e0-d4c4b2c574a9", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:121fea00-50b0-54ab-89f6-a00243457ab9", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1a10a6d9-97ad-5214-9068-3582265e04ea", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7896006b-eba6-5f34-b4c2-b24b7be9ae0b", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fdf84fdc-1b34-5e9f-a6c6-be4f07437ea7", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e9d7f09c-9422-544f-8132-7a937c44ad62", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6c148ee2-7e04-52ac-847e-ac34d4521747", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b7e996d8-5ee7-57a6-8817-f7996ac5a30f", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c18c254b-622b-5601-bd40-951e237033f4", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:881b1c60-f341-5e6e-a81f-8d518f49fc91", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:bf9e51da-0a13-5182-a9c2-93747a2f6aa6", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:28276d59-ebed-5688-938c-4363e38bdcc3", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8cf1de41-6326-55ba-bfa5-acd2d2d47ee6", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2301f4f6-7ee3-5cf8-a637-15e3087f0011", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ea3a6fc5-0392-5ebc-9ad7-4aae3bf6fedb", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework version 5.2.13.RELEASE-tuxcare.4 is NOT affected by CVE-2026-41853. This version predates the affected version range (5.3.0+), and analysis indicates the vulnerability was likely introduced in changes made in version 5.3.0 or later." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3585e2db-57b9-5d91-a71b-07168a0322a0", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.5" } ] }