{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e3e0dd7d-d519-51ac-b2e7-1ad85778ea46", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1", "version": "5.3.32-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@5.3.32", "type": "library", "group": "org.springframework", "version": "5.3.32" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:d6e09320-3e02-5803-8393-d6525f432d89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:52b0a293-b524-5e42-b292-0f1494fcb779", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:074d68f6-1e74-54f1-86e2-cbd95260417a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:618cedc6-1398-5808-898b-ff19a572323a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:c24d26eb-0d4c-5f05-9ff1-45d12e94a59f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:588775cf-95c9-5684-8d35-6e66a52ba14d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:e9278a62-32d4-5bf4-bf28-f929e347e566", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:d5f6bfaf-805f-50a1-ae00-f6808e4c59a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:f07d20cd-0f5d-588f-a28f-d750dc3f87ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:94866597-9704-535e-bdc7-aa222c63c01c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-jms. not_affected \u2014 The target Spring Framework 5.3.32 is NOT affected by CVE-2018-1257 (STOMP selector ReDoS vulnerability). The upstream vendor fix was already present in the 5.3.32 release that TuxCare onboarded. The fix adds a null-check guard around selector expression parsing in DefaultSubscriptionRegistry.getSelectorExpression() (lines 162-164), allowing the selector feature to be disabled entirely by setti...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:fc539617-7f1b-5d56-b867-798a14eefd2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:bc01c4f8-466d-59d6-a15c-525688a9ddd4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:9fde50dc-b6ac-5468-a560-17f88237fefc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:62f1993d-5785-56b8-b620-f4d74ee822a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:a50cbc06-46b7-5207-ab05-0f832cd18e9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:6641a7da-acc7-5f95-b610-277794b3e06b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:e42d9a27-8bf7-57e9-860d-25c7b8c8beef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:1bf6eb1d-c7e9-5f97-b8c4-068e8ea7d0a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:f32a6f8c-6d81-5342-bfac-bf9112033fda", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-jms. Spring Framework 5.3.32 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:49002d85-e918-52a2-9799-a7e36d6e1517", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-jms. not_affected \u2014 CVE-2022-22970 fix was already present in the upstream Spring Framework 5.3.32 release. The vulnerability affects applications handling file uploads with data binding to MultipartFile/Part fields, allowing DoS through repeated access to expensive read-only property getters. The fix (commit 83186b689f, May 2022) filters AutoCloseable, ClassLoader, and ProtectionDomain read-only properties during...", "justification": "code_not_present" } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:314f68f9-b81c-5f5e-bff8-b76178682807", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:8bb76f45-cb14-5b41-b7ef-11c42b9e5776", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:5d92569a-eda3-59e1-b093-de7027e09dfe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:42281065-3cdf-57c2-8315-c50fbf97fdc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.32-tuxcare.1 of org.springframework:spring-jms, and is fixed in 5.3.32-tuxcare.2." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:c565ad89-adc5-539e-b30e-4d9754536d73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:5c670e9b-ca13-5d98-ae28-f1831743f3dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:1b7f400c-9e12-59c7-aee8-c22d14b527db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.1" } ] }