{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e95d851a-c140-5f42-927a-982c9160b411", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12", "version": "4.2.9.RELEASE-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE", "type": "library", "group": "org.springframework", "version": "4.2.9.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:0b2a32ea-c5db-5ed7-be2b-c42214de158c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:06af7f1f-e4d5-58a2-826c-80d8b4ed46a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:2b9dbd4f-c6e4-5892-8f66-030bed1a0eaa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:c6b99931-b387-5fe0-8177-c18fa12e7c8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:1189a9bf-8bca-5bdf-b494-3cf4672f89a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:9f230a5c-85e2-517a-a4cb-27ba404f910a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:3ad49cf7-d637-5bd7-a344-9d9f6339e3dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:58c638d4-affc-5a25-81fc-09166506db59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:07a2ea13-3bf7-50d3-bef0-2d0def81090a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:452a4130-383f-5123-813d-1a004c4f3a9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:1572d7a7-b4c6-5597-80f9-7ef020211d35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:8d9cdd3a-d470-55fe-8ba8-ec710bee6feb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:a4f0162d-e41e-5483-8954-17d6a83ed4ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:97c1e3e9-5774-5df9-907a-1a1515514da4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:490458b5-50a9-5402-9574-914058490fa0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:e840b78c-1c55-56f3-9e59-ac9271f1c8dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:8eabfe4e-207a-5c08-9d7b-af4f2ab52c4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:7f9f3928-f601-57cb-9442-2e32eaedef04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms, and is fixed in 4.2.9.RELEASE-tuxcare.13." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:a9fb1ebc-9e8c-5ce0-9869-c5934c70f971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:5a8ddc53-4414-5781-9afa-9cc2a920a4f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:b3caf470-28e5-5b30-8185-8e8ccacf4d7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:87591f01-be51-50d5-b6bf-1b59cb83e169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:9a8eb935-8de0-5fc5-875c-b5c19272aae9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:51f2fb42-9fd2-5ddc-85e9-a924a0955356", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:07a021e6-9c1e-5c9d-a54e-0c33b877c244", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:53998e9d-3b66-5278-869b-2b80efd20f0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:554c4cc3-59c9-5c78-82e0-4c6b9adf94c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:58d376f8-1aeb-5238-bb1a-945d97a7be09", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:fb2afaea-02c9-540d-acb4-b4fadad7c058", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:38c67b06-fedf-5be2-9966-b51d6f024ed0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:b62ef2b5-681d-5943-9dd4-a824221a36bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:6ab52df2-c914-544f-88e2-cd5b22deee42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:509a97c7-f5c1-5073-8dd0-47f7ee37333b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:0d182467-8cfb-50c3-bd3a-2d63c754e66c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:0f3e226a-6da9-5412-a7af-b696cd8f7f81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:9e831dfa-b139-5f38-8c26-e44fc82c0a55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:6844a407-218e-507a-97ab-036942be47ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:ec376dd4-2ea6-59a7-89d8-4c3084062a5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:8bcae966-2759-5d09-a4cb-0a8d52c63877", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.2.9.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:fa108ea4-0dc4-5e20-a4a5-29d17ee0fb39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ], "bom-ref": "urn:uuid:34f5af97-9776-56d6-ac38-5da226da8645", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.2.9.RELEASE-tuxcare.12 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.12" } ] }