{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cb6c68d9-c495-548e-a363-e6eed9ab79d2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1", "version": "4.3.5.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.5.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:93004ac1-bc05-55bb-8257-3f3bb7a08ca6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:930d880e-a66d-5efd-9e1b-27f4546a21e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0e05b459-d6b7-59d8-8e5d-31c9eca6cf64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6a681f24-d2da-5ea6-ba51-42b0bd64339e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:802ec411-be72-51b4-9ab3-2d1a429ff5dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f1b22271-f25a-5506-bde3-047a8672eca2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e156d395-8ef4-5d7c-9bdb-5018ede6e636", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e18b6978-b37f-5bcb-855a-8c9d202d2f4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:db78c35d-7132-5511-9a3f-345f1865369b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:26271b92-b5c2-50a6-b966-9f7c9b186b8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d55b8604-9ccd-5f0c-b5f8-66bcd99609a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9dc36caa-48c4-5d19-86d7-b5890194a99f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0ab9d34b-f6c0-5804-8780-86365f5f075d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e76385bb-bde9-5a77-b68f-db869b3e7cb4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1162ed47-b0ba-5d94-af2e-3ed8f5f7ec33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b7bcfbfc-3a18-582c-ac2c-ef29b21c4081", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3dc33e34-f51a-5121-8963-9be4678e152f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:aa86457c-b009-50ad-a2f3-872bf5d7fb17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5821b2dc-9128-5a6c-ae3f-c58a12830881", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d541eb0f-6ee3-5598-8a14-17a9b834cca7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:becace41-dbe3-545e-bf31-11a4c7aa6753", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2cc41b04-8323-50f2-9254-e1e0568eb143", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:aa1b4d52-4f2e-5e58-ab96-f95e1ec30028", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fc347b35-9b34-5706-bf0d-81fd28cd521b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bb0ede1b-04b0-5412-9033-8b6011fcc31c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4431b7fe-5904-5607-9e39-a4b9727c5da5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:187c332f-0075-561f-bc0d-c9a4aae85f12", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bdf5aa92-76cc-59d6-9aae-ef196d8498f1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms. not_affected \u2014 Spring Framework 4.3.5.RELEASE is not affected by CVE-2024-38820. This CVE is a vulnerability in the fix for CVE-2022-22968, which introduced locale-dependent toLowerCase() calls in DataBinder's disallowedFields matching. Version 4.3.5.RELEASE does not have the CVE-2022-22968 fix and therefore lacks the toLowerCase() calls entirely. Since CVE-2024-38820 specifically addresses the locale-depende...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8eb0e27f-c661-5b29-a2c5-4d1800226729", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:56993821-544b-5315-a2b2-cf40381282ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1c19097e-7b25-5ad3-94bf-551056708881", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms. not_affected \u2014 Spring Framework 4.3.5.RELEASE is not affected by CVE-2026-22740. This vulnerability affects WebFlux reactive multipart handling introduced in Spring Framework 5.0. Version 4.3.5.RELEASE predates WebFlux entirely and uses servlet-based multipart handling via Apache Commons FileUpload, which has a completely different architecture without the reactive stream buffer cleanup issue described in the...", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:602d198a-69f4-56f5-a4e3-32282c497235", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6d9fbd7f-a821-5b99-a8f7-4e117bbcfaaa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f007caba-b581-5330-a418-e0671f32dac6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c4fae7a8-1bb9-505d-99b0-02581351eab0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0bea7d3f-fe81-533f-9652-ca6adc5a9aee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:49a1bd21-bb3c-5037-b13e-4e7594fc6607", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:49871595-d865-5ae8-b6aa-b554890ed3ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e293d79c-6fab-58e7-9e6c-79d21c70c363", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.3.5.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f94b638a-d6e8-5c75-bd20-cb102187f645", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:62a44f78-aaf4-54f8-8514-8110d7126fbd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.5.RELEASE-tuxcare.1 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.5.RELEASE-tuxcare.1" } ] }