{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d297c50b-f542-577d-bb5a-03704263d148", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15", "version": "5.3.31-tuxcare.15", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:d8c9db8d-16c9-5881-a137-de86ef1cc00a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.15 of org.springframework:spring-messaging and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:99ce31b8-d7fe-5c98-a0a5-d8b312742463", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:a2cfe77c-9ca0-54c0-8118-f56c1658e648", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:a1f74554-ce03-54f1-b6d6-fc517697ccbb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:35e16c3c-84ec-5708-89bc-7253e4905375", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:ddf1b8c0-172c-5859-a7e4-c647d648511e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:5be2df3b-0c05-5fc5-a4a4-e664225ce082", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:f4ffc9e0-5f32-521e-97bc-5ffc7a83dc45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:5fed4447-5acf-5e2d-847c-f3114be0ee47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:5984d82a-bc7c-53c2-99dc-9bdb94a6ee12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:4ea2f88e-2f75-555b-9a91-52d828ca8af7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:34881b29-6f8e-5b4e-af43-e53b86b7cce6", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-messaging 5.3.31-tuxcare.15." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:f7466ba5-7014-577f-96c6-5e906aa0b8d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:dd3ead17-9437-5f50-8ebe-4b319da9b7c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:4e102f25-b3ff-5593-892a-ff1a99ce9e05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:06de04fb-99a7-5d86-974a-4d69e861bd9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:d8e3c92d-ea21-5370-8709-de856d6a340d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:316c842d-e2eb-5793-b9cc-a34ba4619107", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:0c08a1a5-f991-5ec2-8187-e999c9afa6ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:39032bc9-deca-5aec-94e7-cf55b93fd221", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:8470fa7e-3082-5c15-8e4c-bae2c0f07cb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:2e1a3d8d-5d00-5090-90c7-e82017c5151f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:b47e9a71-4b6e-5f47-a00c-31aed4397d19", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.15 of org.springframework:spring-messaging. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:eae482a0-bc50-5a02-ad69-c8e4cf95539d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:87b9a1cd-1386-5264-b8b9-bb85f92b8aee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:5908e1c5-190b-51f6-926a-5378b13c5f42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:19c52a68-cbbc-5ea9-936c-aac1ebb7cf2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:685a7161-81bc-5f4a-9ad9-c100c6ef69ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:8c988c4d-8650-5701-af8c-bb8e63066315", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:f9e7f008-958d-51a6-a323-5f070e911953", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:f61856bc-01fc-59c7-a9e0-01bbe40f7d19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:f624e914-0055-5092-b6a0-ad30235ffd06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:8d2b0bb2-dae2-552b-a1ef-65b71d82d3cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:80b25a34-2517-5b3c-8aad-8153df26d4d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:9d82d561-cd97-5fcc-9611-6b54c6708198", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:abc44170-83d7-585b-8c26-c734c170e992", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:bf7bf9b2-9e74-5fde-831c-43553bc76b77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:508f1b01-4de1-5d1f-b3a9-98571d6b1b2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:ee7c1e39-71d8-5a25-ac68-8de32ebe875c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:abbfae02-a744-5f64-9ef1-4419e45d0852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:95a25b1f-2409-55e2-a68c-5a628017b04c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:4df0e197-65b8-5841-8220-2c26d35166a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:64a970cf-2e1e-59c5-84f2-1527f1ed4dad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:446b7ea6-3201-5034-8641-e26651b8ef89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:9e509996-4b1b-5db1-b0dc-17587195e52c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:2385f052-b48e-512a-aedb-6786c88a633f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:95c7a37d-62c5-5715-949c-c9f0453af4da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:917a1c0e-ad40-5828-8901-3e9dee28328a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:a7eedbe6-9a7c-5c51-ae1a-d3264037d41d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:d182a1bb-d7b2-504e-8021-60ccfc8cb718", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:a6d6c203-12dc-5bab-ab50-17689db3a84f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15" } ] }