{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9f8fe528-fe1d-550b-8c2b-772b93810d19", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1", "version": "4.3.21.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.21.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:760e364b-f998-531d-89f2-99c878dcd0c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:53b42dac-8444-575f-97e0-7ede0bbf7d6b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d916813e-81fa-58fd-899b-4d3e1a78c113", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:02b8c394-ffaf-5226-8f4c-b5999d310da5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:29bee639-d7cf-5d32-bf04-a5cacdb0c272", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5c4a66d7-b6e4-5442-80f9-19225bd78fdd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:60b411ff-e6cc-5e60-af5c-c28735f8ddd4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d4ca5f24-616e-5361-baaf-da67bd856a53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5769d426-77ce-5391-85ae-10b4e3c859f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:044dc42f-ea9a-5831-a204-b2ad393a18a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fee66e69-d063-57b5-8c44-189a31ae158d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:58bb3469-cd61-5c3a-9ec4-bd563f4fa5c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:916aaa86-41c3-56fc-8a78-9874770096c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:779fbb40-9ea6-52b8-b1d7-0fb47057687d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b3a29b6b-f568-5eae-80be-84cf23140bdd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3b375a3f-edb9-542d-a04c-cec291b750fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f05c1328-2d87-523f-8fe7-cae87afb273a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d10d622c-8c3d-53a5-b2b1-a8584352b75a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms, and is fixed in 4.3.21.RELEASE-tuxcare.2." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:94f284cc-b272-5b51-877a-e813acd819e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms, and is fixed in 4.3.21.RELEASE-tuxcare.2." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7f4d4989-b0a4-5be4-83ab-9bd951ff18f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e66e4cda-decc-57b8-b063-680b82255d71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms, and is fixed in 4.3.21.RELEASE-tuxcare.2." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:86043ff6-f906-58df-9e07-4d63468117e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms, and is fixed in 4.3.21.RELEASE-tuxcare.2." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8f9b2036-ec95-5840-8bd4-8a3326eb9588", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:748133f4-1f31-5b0b-a65f-95c1d221b7cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:105d3b01-d4b4-5b46-a60c-a74c20cef5e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b4e7aa82-4057-5ade-a992-fdfbcc965cf3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:52a56e23-7a53-5548-be56-65189b855046", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1a464927-d1cf-5ec4-9340-6dd58bf33efe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms. not_affected \u2014 Version 4.3.21.RELEASE is not affected by CVE-2024-38820. This CVE specifically addresses a locale-dependent case conversion vulnerability in DataBinder's disallowedFields matching that was introduced by the CVE-2022-22968 fix. However, version 4.3.21.RELEASE never received the CVE-2022-22968 fix and therefore does not contain the vulnerable code pattern (toLowerCase() without Locale.ROOT) that...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ec9f09b1-cad4-527c-8165-ce7527087f55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f43cf500-0e20-53f8-aa75-ae66ca5b8270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7d732b90-c85c-51c3-9959-25e1c7d89aba", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms. not_affected \u2014 Spring Framework 4.3.21.RELEASE is not affected by CVE-2026-22740. The vulnerability is specific to the WebFlux reactive multipart handling introduced in Spring 5.0+. Version 4.3.21.RELEASE predates WebFlux and uses servlet-based multipart processing with Apache Commons FileUpload, which has robust cleanup via try-finally blocks in DispatcherServlet. The vulnerable code path (org.springframewor...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8d0ded05-e539-519b-8a03-0c4025b4b3a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9d4d430b-b1cb-5224-a42a-75482aa94240", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fa6afb31-e423-51b2-9dd4-e22fd8cc5e94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1b98553d-ae99-5373-aa53-0156c0f4d1af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b73bbffe-86a4-5770-956f-0129fb978ddd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:37f2b1d9-740c-528b-a928-7ca4d437048b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:70af74c0-f2b5-5aed-8204-e13db6f8bbe2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1260925f-697a-5a36-80d7-d1486fc4ed05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47888 affects version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:16efdd91-a30e-55f0-a17a-527ea6ba0b5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:36ee8da0-7bb9-5d07-937a-f2bb54b61122", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.21.RELEASE-tuxcare.1 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.1" } ] }