{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:35cb0f75-e9b9-53c8-9f50-ca9cd44710a5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2", "version": "4.3.21.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.21.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fa5d6448-63b5-5fea-9c36-283727e24041", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d2917d59-06bf-5b01-9ab9-083006cd88f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ea9ecd7b-00ed-5f89-b897-80dfff219c05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8951f0f0-8492-51c4-a09f-6def8435390a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b53b4a0b-64b1-5cd5-b006-d00734cb85f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cfb9d5e6-7c2d-53a0-8b14-d5c6a83d919d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e08f95f8-88e3-5879-9914-1da5b10fa211", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:30d9e506-94db-5bf1-b26e-278aa3c39e04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:149bb9d5-32f6-5efb-a236-692d08a03213", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:28e4747f-6852-536c-b49b-876241e34656", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a179948a-708a-5768-81da-474edf792427", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7b941f05-6248-5593-bf51-831d7d3792d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5b6696e3-1556-5485-9c59-3ca659bf958a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:91132995-7abb-55ef-ab52-c199d83394fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:038cbd9a-814f-50b5-89c8-ded0b9f31877", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9574e982-8e11-54de-a58d-ac1ad85dffd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:771cb32e-a684-5d1b-99c0-ffb079398212", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:128715a5-c64e-5f90-b1a5-db7a12836140", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7f27793b-9f44-5b05-8c9f-554e9e1a157d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e79a01cc-88c8-5c9b-aaea-e0fed1eb9e8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:980b130e-ef6a-51fe-b0cc-44c78afbd63f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9e45e158-8a2c-5547-a8e3-f8f4e62d31f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:86a98740-7eaa-52f2-9b77-35591fbfb805", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:eea0a2d9-b453-5377-be9a-6c8f3ba1b3c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:767f5f58-a700-59f0-9cbd-731c9e499f37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bbeb15a7-8d62-5d7e-8e49-4a2e5ac08b21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bb002108-e129-500e-a856-275937011f9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9db3d464-7870-589c-bbbb-1381509d4bf5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms. not_affected \u2014 Version 4.3.21.RELEASE is not affected by CVE-2024-38820. This CVE specifically addresses a locale-dependent case conversion vulnerability in DataBinder's disallowedFields matching that was introduced by the CVE-2022-22968 fix. However, version 4.3.21.RELEASE never received the CVE-2022-22968 fix and therefore does not contain the vulnerable code pattern (toLowerCase() without Locale.ROOT) that...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3b20aa55-9ca3-5971-8cb9-937419f5abc1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:441d9c7a-53fe-5ef3-98cf-072c7ee73532", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3e442a45-64ff-5ca1-9bd9-037dbd01749a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms. not_affected \u2014 Spring Framework 4.3.21.RELEASE is not affected by CVE-2026-22740. The vulnerability is specific to the WebFlux reactive multipart handling introduced in Spring 5.0+. Version 4.3.21.RELEASE predates WebFlux and uses servlet-based multipart processing with Apache Commons FileUpload, which has robust cleanup via try-finally blocks in DispatcherServlet. The vulnerable code path (org.springframewor...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:184be697-cc1b-57c8-9826-b3fbff468be6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ad678f0e-1ebc-52cf-bb43-da69a9369a6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ed7def51-5baf-5a1a-9e69-646db79e3669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c5ef6809-9dba-571d-80d9-2a43c47903b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4a92a6e8-3c9c-5194-be22-6cd8b70eed0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:79d3afed-a399-5503-bfe6-cbb7e2c57c69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5412650a-2bb7-5894-9cb9-e368a3863d9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ecfefaaf-cedf-5fa9-9f35-32e6ebb756f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47888 affects version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:823aeb85-9eac-597f-b6ed-8204e18378a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4abcd6b5-681a-54ef-a707-50bc02aa1002", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.21.RELEASE-tuxcare.2 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.21.RELEASE-tuxcare.2" } ] }