{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:233fdd2e-c967-5bec-9234-6d1865236be8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2", "version": "5.3.32-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@5.3.32", "type": "library", "group": "org.springframework", "version": "5.3.32" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:c74794f0-3ea6-5f61-b1c1-c37ad6566821", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:4b70f8a1-92b2-5125-803f-9bea90fa0575", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:06d7abe5-18b3-5c68-816c-6c039534fa2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:cadc2a7a-fc06-5978-8dfe-2c54695b99c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:77d29dee-3ae6-5563-9651-3f67f78844d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:a102d864-3099-51cb-bb14-9438d3673ed8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:37dee4aa-c014-5b6a-ab8c-3b4ce735c5e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:0f8e33a6-78f9-5c77-9de1-24c3df5273b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:eda1a6e6-e471-5d6e-9006-da6ff51f6796", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:137ec073-d613-59c9-9a08-5c2a888873ae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-jms. not_affected \u2014 The target Spring Framework 5.3.32 is NOT affected by CVE-2018-1257 (STOMP selector ReDoS vulnerability). The upstream vendor fix was already present in the 5.3.32 release that TuxCare onboarded. The fix adds a null-check guard around selector expression parsing in DefaultSubscriptionRegistry.getSelectorExpression() (lines 162-164), allowing the selector feature to be disabled entirely by setti...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:54254a50-9e16-5037-8f20-4a929d70ba03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:7e55701a-ba21-5afe-bdee-2f27070d99d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:65d4a559-73c0-51c9-999b-0bc440f2bdc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:adc61fb9-6bf2-5a95-aaa0-13e9b0ff92ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:f3cf154c-25b0-589e-84f0-cc80b3f1fa5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:58a0bd51-0306-577c-a242-362eba573b1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:91671e53-1923-5ef9-a8e0-b621a4bc0046", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:13ca9d08-bd1d-5797-8201-7b238e6c0587", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:44204080-78d9-5229-9833-d8ec9b2c307b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-jms. Spring Framework 5.3.32 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:befe0a8c-b1da-58c2-b2f9-deacbf98cba3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-jms. not_affected \u2014 CVE-2022-22970 fix was already present in the upstream Spring Framework 5.3.32 release. The vulnerability affects applications handling file uploads with data binding to MultipartFile/Part fields, allowing DoS through repeated access to expensive read-only property getters. The fix (commit 83186b689f, May 2022) filters AutoCloseable, ClassLoader, and ProtectionDomain read-only properties during...", "justification": "code_not_present" } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:458fcd17-05e7-527a-92b0-5f3d4d83651f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:583e776a-1bc3-57dc-b1c2-3f11c4c67ebd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:ddba9f10-4f6c-528a-b491-219828ce7ee8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:ee14c68c-d2b1-57e5-8e79-c44998d13b67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:3ce4ac9c-291b-5d5f-b6f9-3387a64fd472", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:0c5e3baf-9cfa-5829-81c0-fd0d2382f900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:3dc328d0-ede9-563a-86ac-7d827f6cd836", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.2" } ] }