{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:36c07f62-35d1-5b02-bb3d-ea11d832d4f5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5", "version": "4.3.9.RELEASE-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.9.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:95e51585-409d-53d4-bc5e-4518a76a0bbf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:5c53baa1-1801-5e0c-ad69-2c37a22019ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:380f9d8b-a194-5e42-9648-d1f0a7b6fdba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:0cb4a7b9-42c8-56e6-bc79-d55958f83ba9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:51df5f0e-1ac1-5bc1-bfd1-f5fc1c2e43e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:fa6ff94b-61fa-58aa-b6f3-b2404323502f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:9d9a52d6-ba5d-5cc5-a45d-647139efeb07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e29a42f5-a825-5059-bf54-215d95f4504f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:38248d1e-ae12-5e18-8a73-6cc6575c7a1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1c4b59af-f820-5ae5-8c31-815aff96d71d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:056cdcd6-d610-52bc-beed-991305f1af45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:757b5d1e-4de5-5bdc-a533-dc42728c8a66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:51d66f39-e4d7-53a7-91d9-11f1c482ed9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:a8d35460-e3db-52e6-bab1-3a6ddfcb7236", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c031233d-397d-5a3e-a3f8-ba0252d59f91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:0599c9ad-6371-5980-b5fd-a3ed606512fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:7c8565a2-bbe3-5472-a590-44ca9f4cb6e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:735e432b-e42e-5a59-b672-59a57cd1ecb7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:7eea70e3-34be-55b6-875a-e995032adb53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:afc45a1b-b089-5a90-89c2-ea584f780ce6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:9136d34e-acd1-554a-b0be-a002eded5fb1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:3a690819-8106-5bba-a186-7823cf55f383", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:dddeb310-6578-5e07-86da-9c3b23dc8da2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e700c73d-ce58-52b2-9bd4-3c3d678d0234", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:d5d74f18-766c-58ef-867a-0d1601dd6f12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:edbb8d39-5c14-55ef-b947-8b7190ef589e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:2ede9826-d2c3-5324-aae5-a2ca11875506", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:0f3ed74f-de07-59fc-9e29-d7c8a374e783", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms. not_affected \u2014 Spring Framework 4.3.9.RELEASE is not affected by CVE-2024-38820. This version does not contain the CVE-2022-22968 fix that introduced locale-dependent toLowerCase() calls in DataBinder's disallowedFields mechanism, so the specific locale-dependent case conversion vulnerability that CVE-2024-38820 addresses is not present. However, 4.3.9 is vulnerable to the predecessor vulnerability CVE-2022-2...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c7070b20-1d4a-59e9-9002-d6fd990c5746", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:2f4f1337-5b39-50b2-b869-f2d6352e0407", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:aa544215-e5ae-59d7-9dce-8f6d1b72240c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:5d512f39-2f07-570e-a516-b44ed8adab56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:22ad0275-b504-5b88-886b-a0a5585dee68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:5e35d03d-f973-57ea-9f6e-db6dd8e720ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:faf0db30-cf46-5324-b3ee-a8bf06385045", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:70bdd42b-dab7-5968-ae1a-e9275d031e55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1855de87-7337-5544-a35e-bf2082f9888b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:deafb854-9983-5fb1-a0fb-d1a3c2695535", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.3.9.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e57b6d77-aa59-5e8a-bc69-52f4b66c85ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:eaa15b1f-cd7a-5857-90f7-d1f2644db07f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.3.9.RELEASE-tuxcare.5" } ] }