{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c6b1ada8-511c-5c97-9c52-414c10e9eb0f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1", "version": "4.3.27.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.27.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d6175d49-02d2-55f3-ac29-164b23a25943", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:370b3bde-1ab5-5d60-999f-47884e45bf4c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6985418b-0de1-51fc-bcb3-ca2034d412dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:29f0d320-849d-5612-82bf-e2f523a64d85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0c9b497f-d4fe-53e0-9d8d-decc46a5c945", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:def1524a-1c77-5f5b-9842-bb3b4e3f945f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b2f75871-6747-532c-9c23-7eb8eab4b4b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c9b36cf9-ea08-5fc8-b045-f44bc1ea3fc3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e8000fcd-c524-5430-8d18-9eed82f3b790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bba3bfca-b9e4-5c75-97cd-42ee8169f46d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms. not_affected \u2014 CVE-2018-1257 (ReDoS via STOMP selector header) is NOT present in spring-framework 4.3.27.RELEASE. The upstream fix from commit 246a6db1ca (authored by rstoyanchev@pivotal.io, April 2018) shipped in the upstream 4.3.27.RELEASE before TuxCare onboarded it. The fix adds a null check before parsing selector expressions, preventing malicious SpEL expressions from being unconditionally evaluated.", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1a3fa23c-ae24-56b4-aee7-13d9b115a1a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1c3bdc42-393b-5b21-bf10-1ecb29def4ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0f338307-59a4-5215-9696-124ebf60f11f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:436bfac9-a727-5937-be27-41bd261d5db4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2cd98c43-b1e7-5709-a8e7-dfb39395c87b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ac65d991-80da-5f79-b77a-3fd81d708c85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e288e7c0-d659-5acd-87a3-467c39a6a89d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cad98347-d589-5551-be8a-a43137e14b0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e2e40242-526c-5615-b60e-d48d5efb4c06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:30d9defb-84c4-59fa-b6a2-5c08492fee50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4fadce73-f960-585f-9713-406e587ed75b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:dd275b02-93bf-509b-af33-145fd4963acf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e3ed2163-d0ee-508c-b437-dde2d6e9c3a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:52468d0a-e239-54a6-93a0-d1263cdfc03c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3e82f42b-59b0-5308-9c9b-47b5a2db5eb4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1e949402-c6c5-5650-9295-21b79822bdf4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:531a9c4e-ac73-577d-ae1a-087e0e7daaee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c496397d-8acd-5b7d-961e-8293815fa405", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms. not_affected \u2014 CVE-2024-38820 describes a locale-dependent toLowerCase() vulnerability in DataBinder's disallowedFields pattern matching, introduced by the fix for CVE-2022-22968. Spring Framework 4.3.27.RELEASE is NOT affected because CVE-2022-22968 was never applied to this version. The DataBinder code uses case-SENSITIVE matching without any toLowerCase() calls, so the vulnerable pattern described in the C...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ad7ceb2a-3c40-50e2-ade0-ba838e1e49bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0fb449e6-ae45-5a13-a852-3c4f5d17d6e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:884944cf-18cc-5d28-abd0-2dd08eda108b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms. not_affected \u2014 Spring Framework 4.3.27.RELEASE is not affected by CVE-2026-22740. The vulnerability is specific to WebFlux reactive multipart handling components (PartGenerator, MultipartHttpMessageReader) that were introduced in Spring Framework 5.0. Version 4.3.27.RELEASE predates WebFlux entirely and uses traditional servlet-based multipart handling with a different cleanup mechanism (finally block in Disp...", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3f7b9a87-5d40-5caf-bc20-3830f2a229b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:deefcd4a-5d93-557a-9b5b-a31b852f03d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:297d938c-6e0c-5a79-9c5d-a2f7ab827eca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cb367ad9-8152-5b24-8722-18c8878d29ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0a80afc7-b159-59ac-a940-e52db097463b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:454235f3-48d3-53c2-b0d4-3c142d6d3794", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:db07ab30-ea7a-5ab5-9601-27a16b53c922", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:99aca7dc-c25b-5869-91dd-37ddcb7db4d4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.3.27.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:374d39d4-910d-5f50-a6da-64975fccb1b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5bb04579-8bee-52ff-bb7a-a68e09f6f24b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.27.RELEASE-tuxcare.1" } ] }