{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:af5d7eef-0b23-5217-953d-9cbdd5cb9006", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5", "version": "4.3.4.RELEASE-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.4.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1f9c2425-87c4-5e73-9b59-22c56a0e8e3a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:7331fb16-fffd-5d82-b94c-76a0630b5049", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:bf31b9c6-4e5e-5b71-9d31-51d512051887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:ec2eef47-127c-55e8-950b-e46c7d49e37d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:96ea0c65-76e7-5e02-b44d-5f294f670034", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:7f5f0e9f-b65f-5197-9468-1d26aecfded1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f13b2a95-6336-54bd-a4ec-a4152457287a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c33909af-9921-5ff3-911f-1f730a95596a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1c81dd28-a296-5a2e-bbd3-2a12f1fff3e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:9ac8d2f0-0e3a-53e0-950a-c50e0df26d9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e1ec7e29-e2d6-527b-8c65-7295a06cbcec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:340bf3f4-c3a4-5e9b-979e-be99ec476093", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:26dbaee4-b8ff-561a-a907-4a221778be9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:57a05688-d8d7-5f28-bb32-8b1eb1263ee0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:ec64aaf0-bbf5-508a-afc6-35218a005594", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1143ddca-2224-5227-9d28-acfe6987e387", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:2a3c74a4-3ab0-5e14-94f5-f6c1fa66852f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:cc0e9109-2700-5518-8c12-bc4aceb8a256", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:5653b317-74dc-5a01-bae7-8c209b90777b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:a1a68279-be58-5472-912c-b9540666bb23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:355f5cf0-1ef5-5e5f-b4ca-e5c9df804eb5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:dceb3306-8c4c-5b32-b78e-3ad7d5cc30d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:d0936343-2dfc-5910-b13b-f4f6b8b26d0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms, and is fixed in 4.3.4.RELEASE-tuxcare.6." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:93bcc2a7-5508-5fa3-b131-0dc01c1848c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:674fae4b-e00c-5fc9-b11d-77594b090c31", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:3d3cb0f6-fd83-511f-83b1-6c53fba86066", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:2c3e0fae-03f4-551e-a064-11d51b17b00e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f9e408fd-5099-51d5-a513-4f06c83dc039", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms. not_affected \u2014 Target version 4.3.4.RELEASE is not affected by CVE-2024-38820. This vulnerability specifically addresses locale-dependent behavior in String.toLowerCase() calls introduced by the CVE-2022-22968 fix. The target version does not have the CVE-2022-22968 fix, therefore it lacks the vulnerable code pattern (toLowerCase() without Locale.ROOT) that CVE-2024-38820 addresses.", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:4b17b7bc-13b8-503b-9570-dd19af59106c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:01e1de25-6814-52ac-8818-22f899236709", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:3bfc4671-55a5-596c-9a83-5d7e3152a152", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms. not_affected \u2014 Spring Framework 4.3.4.RELEASE is not affected by CVE-2026-22740. This vulnerability is specific to the reactive WebFlux multipart handling introduced in Spring Framework 5.0+, which does not exist in version 4.3.4. The target uses servlet-based synchronous multipart processing with explicit cleanup in finally blocks, a fundamentally different architecture from the reactive stream-based approac...", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:3dd07f75-47dc-5c00-91a5-56ee31bb2b48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:9fb14039-729c-596b-8cee-8cca8dba25ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f77de2d6-24b6-59f7-bb58-ac4dcaabeb5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:5f82627b-3c9e-5d43-babe-7fe225da8e43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:57f6ed64-fac1-582f-b33b-4f211cee1cd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:3217689f-0023-5fcf-ab46-62e7c7e08a0a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e6392a54-7cdb-5647-b0f0-0b89c2025c64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms, and is fixed in 4.3.4.RELEASE-tuxcare.6." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:b581014a-f5d5-5404-975e-2694de80f30c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.3.4.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:9a7c5488-cdfb-53d3-a1ab-6e3267fba40e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms, and is fixed in 4.3.4.RELEASE-tuxcare.6." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:8d644b2c-2252-5a57-8750-b5cb7d90a928", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-jms, and is fixed in 4.3.4.RELEASE-tuxcare.6." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.4.RELEASE-tuxcare.5" } ] }