{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:341748be-25b0-5c1f-8196-40bccf05231f", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-messaging", "version": "5.2.13.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:3d8a0ea6-acaa-52e3-90af-2a66496c24c1", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:36428481-e4d9-5c81-b385-8f224677d87a", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0b76dcd2-138d-5229-96f0-eb9c5e93c647", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fbe871e0-235b-5923-ad82-8760c4d6c2f5", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b3fce8c3-e45c-5876-856a-d35b17b8228c", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f641ef41-a037-5b9f-b214-9d56292b4e92", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d05439fb-738d-5900-bdf4-357d7167fb75", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f1c7cd14-e67e-5581-9ced-ccaad591b690", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:051ed393-33a4-51c1-82c9-61496f5f6921", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:37db4c9b-3688-59cd-a205-3bb60e4dc3f3", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4acfafcf-6a67-5993-bd9b-8f5a87993d13", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9a3ebec8-89b9-5a48-b17d-ad0eb33d98e0", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:556d1706-924a-59f3-a6d7-dfe6ee1c9694", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bd158220-2827-5fee-9304-6c7dcf989528", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:12976430-707e-56bb-b6de-a76bb86bf59d", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a93d536f-eaaa-570a-ab5c-73ea744b0d72", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c94eedca-1b06-56db-ad5c-a1d920cbcc8f", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:62b846cc-0408-55f2-a56f-7e68c759182d", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ccc951dd-ab30-549f-b6e5-4edd903225a8", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:89ea9b80-a55c-5b1e-927d-d0a1689b9e62", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:cc0491b0-fd63-5777-badc-6bc8cea98125", "id": "CVE-2025-41234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2da27a9e-6861-5d89-8da8-96dae52d26ab", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2bdb79f0-5373-5113-a252-7a318d0185f6", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:410edb78-6aef-52f0-aad9-cf2d98feebb2", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:369f3d9d-ffbe-5481-a322-86cfea6d69f8", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:af8dd323-8dac-5e4a-94ba-6762e7689263", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9667fee6-101b-556c-85d7-577bd42cc937", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:402bcc0d-4847-54f5-87ec-19003e14e002", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:24d804b6-415a-59f6-8355-bf98440874e0", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d0d0e1b0-ad3f-5985-92ca-1d995198e465", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:04908a13-a059-546c-aae4-58b73883afc8", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2c3bf6fe-a437-5fb5-850e-801d12554cc4", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6ea7980a-95e7-53c6-bc2d-fca5cc94eb7e", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ac32cce8-70f6-5f5d-966f-f8e4742a7c99", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0d61276b-8ce3-5b3c-825d-d6891b55c030", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ffd6dcbf-3c1e-557d-8fbd-16a84c493a3d", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:156ae073-590b-5173-a585-665d61767d13", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ed2be920-127e-5915-9874-c54b7c9913be", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c87628d4-2a8d-595b-aeb3-455af658fef0", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:304ad3ce-4fae-5603-abca-9d0aa9729c31", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b9b08980-2177-5ac6-8b19-797dbaa1b81d", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4f6a0b4a-2714-5276-a4bc-dc7a6f8aac06", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework version 5.2.13.RELEASE-tuxcare.4 is NOT affected by CVE-2026-41853. This version predates the affected version range (5.3.0+), and analysis indicates the vulnerability was likely introduced in changes made in version 5.3.0 or later." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:33cdd77a-f233-5856-99b3-f298f94e30b3", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.6" } ] }