{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a14cbe61-1b9a-5554-9213-9af42465d6b3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1", "version": "5.1.13.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE", "type": "library", "group": "org.springframework", "version": "5.1.13.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:34f5c1d0-2ec8-5de0-90e6-e3fbf95db0ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e42364e1-1809-5bda-9368-cd53eea84da7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c363a61d-7257-5d34-a1c3-60c85cf00c5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d1b42c08-9855-5aac-bffc-0441c301e2ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3771630f-a699-5276-bdfc-8d8b991871b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d4a26900-e862-54f1-a56c-c1bd68c972f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d80d3e35-cba2-50d2-b486-c3b0b14b6802", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f80e0593-a581-589b-a192-ad3289d44d46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2fdb8e6b-2c5a-5f92-bfd4-16c65bb385a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:27d6ecbc-6a8a-5723-8292-af21f815dec0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6, 4.3.x prior to 4.3.17, and older versions. The target repository is version 5.1.13.RELEASE-tuxcare.1. The fix (commit ff2228fdaf, SPR-16732) was already present in the upstream Spring Framework release 5.1.13.RELEASE before TuxCare onboarded it on 2026-10-25. The fix allows administrators to disable selector expression parsin...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d139f718-36ac-5d02-9d48-17210ac59cdf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b525792a-06a1-55bd-a972-9b3434f8fda1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2b301cdc-a28b-5815-a06d-e6b4e331cc8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4afc43fa-364c-51a5-ba08-15e57ee83652", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:26ef4803-63f4-5fe4-b074-29181b8ead6a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fde9aa94-381f-5d3f-9b27-60cfef15bb01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d14cd427-928d-51b3-b699-ee167ff452a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:582937f3-0a50-5bee-8ac2-4dfb9a41bb05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7ea148a4-4ef2-5c2d-9168-50ecf11f57eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c63458bb-c518-55b6-b910-d15e900efc7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b20dc3ee-43ec-5dd8-8cc4-59de66ceea09", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8d4a1017-3a18-54d0-935a-306decbc64bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c1be21b4-7401-5c32-b5fa-67c54cfb7e04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3575aa3f-93ea-5280-aa46-b031e9b5d5f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3047b49a-b5ce-5284-a6d5-55c7a5707a28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:39dd0aab-8f2c-5852-a892-a7be0f063b26", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 5.1.13.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a13011f7-55c2-57cd-ad3c-c511ca82f94d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.13.RELEASE-tuxcare.1" } ] }