{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f3005abf-1260-51c7-97fd-fb44a48707f8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1", "version": "5.1.7.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE", "type": "library", "group": "org.springframework", "version": "5.1.7.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:51fe1f27-5c64-5c2f-831f-162b8179ac98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d9f788ac-71f7-5c28-93f2-8cbc6d16cca6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7fbbfc3e-7c2e-508e-b412-39c6ff82b0a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6793685b-4f6f-5084-b3e1-529d216b1834", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2151eed2-95cc-58bd-b8f4-a98f9cce7a80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6cc55ed4-e6f6-594e-8aee-4a6867cd15ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e05bd880-c760-57e5-8ce5-bc63b67ea3c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:60cb1241-9a96-5b6d-b4f1-af8bdb8779a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f2b01270-dd66-5205-aa9b-778f8b303087", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2faed1fc-21f1-5aa2-80ac-8dd341b1e5f0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms. not_affected \u2014 The target Spring Framework 5.1.7.RELEASE is NOT affected by CVE-2018-1257. The vulnerability involves a regex denial of service attack via malicious selector headers in STOMP subscription messages. The upstream vendor (Spring/Pivotal) fixed this vulnerability in commit ff2228fdaf (April 2018) by adding a null-check guard that prevents parsing of selector expressions when selector support is di...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:dcaa9ef1-14e9-512b-826a-f85e5eb9212f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:65d15dd0-fc0c-5565-9e95-9ce657e88348", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:49d23e11-73d6-5133-be57-d4faac7db7c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:644848f4-0df9-5bdc-8c30-bcf1e22b3d8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:649923ce-d2f2-560e-9531-4e1b50184f02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:484365b7-6ec2-5a9e-ac75-594b162aad42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f9489109-fab5-5717-a749-8d4f2d6916a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2805bdc4-7678-5544-9a61-917962693b5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:45d38711-b3ad-501d-bb17-071d8bacbc24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:10c299ea-f12f-52e3-82c8-68428d793199", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4cec6999-39a2-5bc0-80b4-2c2d606cbc8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ae4fa6fb-300e-5113-9b67-1cfa5c7b986d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0b2db43e-0ee6-5145-b281-dfae60a49466", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:17c33061-6b38-5f83-998d-2559accdf5a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2bfadd80-5d22-54e3-afcd-9e9be0d43a48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ca9f8d1d-f862-5496-a4ab-44bb6a926e19", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47888 does not affect version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 5.1.7.RELEASE contains no RSocket code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:559daff5-c1a1-55b2-a602-6fc452a78628", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.1.7.RELEASE-tuxcare.1 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.1.7.RELEASE-tuxcare.1" } ] }