{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bc954616-da35-54c8-bec4-bd49355a7b04", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6", "version": "4.3.25.RELEASE-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.25.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7ac74c46-b256-5682-8122-afdfe647db75", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9db10416-9498-5e23-b5e7-f6e694bf94d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:db4944af-18c0-5eeb-89b3-88faceeed27c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:57077f55-2971-588a-a2d1-2e28bd9810eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a2a016cf-28c8-50cc-8e2a-7834dac0875b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a9f1ed9d-ae31-5bf6-a1ef-843bad6b6805", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:449957f4-926d-5a3f-9d1f-e9a073e052bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ea397d37-1dc8-5e3a-8715-f580022ce641", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9c4255ed-84c4-582f-b54b-6d8ebec16629", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1b3e4b5f-7d2d-5a26-ab90-1f51563b88e4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms. not_affected \u2014 Target version 4.3.25.RELEASE already contains the upstream vendor fix for CVE-2018-1257 that shipped in Spring Framework v4.3.17.RELEASE. The fix (commit 246a6db1ca) adds a null-check guard and makes the vulnerable selector header feature configurable so administrators can disable it to prevent ReDoS attacks. The fix code is present at DefaultSubscriptionRegistry.java:154 and SimpleBrokerMessa...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:4a33b678-f48d-562d-9ddf-f5b88d9919f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a8af8e30-b071-5cc3-8e0f-aa9ea890c833", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:04bc5a12-b202-569d-8742-d0480755eff6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:f0b480af-3780-5d41-91db-9121c7916c94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:42113197-505b-5fdd-80f9-c9efcdf83753", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:38eac138-789d-58f7-8090-f5d7bfc76cb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c9d5fca0-60ba-56b8-bdc0-df7642823951", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e432476c-1fcd-597a-a272-b271e3f4779b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:8342cdf0-c115-5aa4-8c90-ced31f57bed3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:40928909-9b6f-55c6-ac7e-b59c6fe98b47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:59457ca3-4bbf-5a0d-85b5-f6878e0ca103", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e9451da2-5120-5524-9512-61099499ce95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:5c23f0c5-11eb-53ad-a49e-af805ce9b9f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:2684cb15-381f-5ea6-8101-7d48644663d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b81a6bf1-34a3-5853-b739-9dd5a2e86108", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3438991f-5337-5e0a-b9f7-0d890081ef71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a7c25278-b7b5-50a1-b827-db911eafacce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c990b6c0-5366-55b5-b933-9cf204054c60", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms. not_affected \u2014 The target Spring Framework version 4.3.25.RELEASE is not affected by CVE-2024-38820. This CVE addresses a locale-dependent case conversion flaw in the CVE-2022-22968 fix. The target version does not have the CVE-2022-22968 fix and therefore does not perform the toLowerCase() operations that CVE-2024-38820 addresses.", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3992e9d6-f68a-5d20-9fb6-7eeb3f9fb11a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:304ee9a0-22cd-569c-be31-08bae10bac64", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:46657443-8f8e-5fe8-81b4-ffc203960405", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms. not_affected \u2014 Spring Framework 4.3.25.RELEASE is not affected by CVE-2026-22740. The vulnerability exists in WebFlux reactive multipart handling (introduced in Spring 5.0), which is absent from the 4.x series. Version 4.3.x uses servlet-based synchronous multipart processing with explicit cleanup mechanisms that prevent temp file leaks.", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:cc6553f5-427b-5b14-b026-189d9d832c40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:fd01f80b-2066-503e-8d02-89b108b8990c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1c222c6d-19c6-5589-a3db-763ec70df2ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3fec0756-75a7-5757-ba80-350378014f91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:35bd5897-f07a-5e15-b8f7-f60d57db9f7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7ef66e0a-ad5a-5b92-849b-9db78d1177d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:fec4a13f-40f9-5ade-b10b-106497a81f1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d30a2eff-cd2b-5923-97c5-08e34998b1e7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.3.25.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3bf80456-4194-5ae3-b8c9-7befb73719a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:657f1ece-609f-534d-92cb-11fffc4adf11", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.25.RELEASE-tuxcare.6" } ] }