{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d3b7e713-23ce-5689-9270-2e8c56c50ff4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1", "version": "5.0.0.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE", "type": "library", "group": "org.springframework", "version": "5.0.0.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5d0d3e00-a700-550a-ba2a-2d7da7c8b0a1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms. not_affected \u2014 CVE-2009-1190 exploits an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in Sun JDK before 1.6. Spring Framework 5.0.0.RELEASE requires JDK 8 to run (sourceCompatibility = 1.8, per build.gradle lines 114-115, and README documentation). JDK 1.6 (released 2006) fixed the Pattern.compile algorithmic complexity issue, and JDK 8 (2014) is well beyond that threshold. While Sp...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:12b71f9f-7bf7-5887-a9b7-34776238b974", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a6d958b0-7927-5ba6-8eb3-180c2a7edd1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:25b69942-f077-5c47-a2a5-70438519a73a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:82888785-0229-5c25-ad8e-1e4a72b899d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:de00f63e-5bdf-5db4-92de-79300a9b5791", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8ebf7666-293a-54b5-9032-425719883dbd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f0615768-c75d-5bf2-b715-d7fa91353c30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bf56a24c-b11c-5ad2-8fbd-aaaca1f6a483", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9564b2cd-899b-5236-b173-ce2a1e9819cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a4211d7f-d83c-5b32-8736-2ae378ef1354", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:aa27c92a-d976-5fc1-8cb1-dd6a9b008ad5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:50180b44-319e-5fd9-9171-7bef9392f4bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4e19dac7-1cca-5e25-8149-eca540de2f5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2dade774-82a0-5e56-a23c-9e371ace46a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8a8c21ea-bc99-51de-8bf6-2fa9a38316a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ed11813e-d030-5879-bcf1-b2bad98c4224", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b04a49f0-65bc-589a-b2e3-c253884ef338", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c7151862-5842-5b54-aa2d-98f000ebbca4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a5283f7b-1ac7-5745-a113-230e14a9155d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cdd34d95-aaf8-56e9-8900-9248485bf5d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:df74b67d-851a-588d-8192-a2c9148ecdc3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:75ca23f0-ecc5-52ad-96d6-e1d80b25e4ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:aa73a0ef-8d2a-54c6-9445-43aa787006c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:96dc43b8-e50c-5099-a506-b01c65db7772", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d8850319-9420-5f3a-8422-9f534efc753c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 5.0.0.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cabe5740-d1ce-5eb6-8582-3a45470d5800", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.0.0.RELEASE-tuxcare.1" } ] }