{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:491b9966-6d56-536f-a94f-582d3c681870", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3", "version": "5.3.32-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@5.3.32", "type": "library", "group": "org.springframework", "version": "5.3.32" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:c04dd51d-dd02-5455-8872-373cafd538ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:750d1edc-905a-5d99-97a3-6c216c567194", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:5a8ff333-613b-516d-9b95-7035a1da46a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:6e1015c6-f55b-5090-aaeb-7e5d0814c083", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:aba7d6bc-f8dd-5b48-9172-4ef2a9eb42b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:8f8e72a9-fd70-55fb-9d90-43e0831d3e7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:9266e86b-831b-5aff-9104-65abb858e002", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:76a13392-b664-577f-8d7a-f53c4f9a7f5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:3a85caf0-7010-5868-8939-23a71450b33d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:0c970f02-5ca9-5a04-afc4-d0236719d6d9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-jms. not_affected \u2014 The target Spring Framework 5.3.32 is NOT affected by CVE-2018-1257 (STOMP selector ReDoS vulnerability). The upstream vendor fix was already present in the 5.3.32 release that TuxCare onboarded. The fix adds a null-check guard around selector expression parsing in DefaultSubscriptionRegistry.getSelectorExpression() (lines 162-164), allowing the selector feature to be disabled entirely by setti...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:4bed7295-d2e4-57e6-93b3-1ad1653dfc59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:71dbe3d0-f6db-55e8-86c7-44d3ced14938", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:489f32e2-bf62-53bb-bd02-4c26904c4d78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:24ce7840-0b71-50f6-a6ec-453b36146a3b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:2ba09b41-725d-5b3b-87d0-c5014d338c80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:78068c27-2fba-559e-af69-a72351ca7868", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:bb776323-8e79-5c25-b9d9-03d4f8271887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:99db0db7-6779-528e-bf90-cc22eb4b88cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:1e4c5bfb-2c45-5381-9c8b-9755ce79877e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-jms. Spring Framework 5.3.32 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:a261c88c-83c8-52aa-9a7b-59ad75ebba55", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-jms. not_affected \u2014 CVE-2022-22970 fix was already present in the upstream Spring Framework 5.3.32 release. The vulnerability affects applications handling file uploads with data binding to MultipartFile/Part fields, allowing DoS through repeated access to expensive read-only property getters. The fix (commit 83186b689f, May 2022) filters AutoCloseable, ClassLoader, and ProtectionDomain read-only properties during...", "justification": "code_not_present" } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:40a7cc6d-9fa1-576f-bd76-4ea290ed6884", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:8d0572af-e24d-514f-b5b3-b96e44bce64f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:fb610836-4c0d-5b30-a4f4-687a6f76c944", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:7c3123ec-71d1-5fe8-9ef6-2b6416d2087a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:286611e8-67d9-5f21-b517-12c093e010b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:c2f52d3b-93c2-5050-88e9-90e1e9b8bd21", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:9a0933a8-1711-5846-8d37-f1b5c55f78b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.32-tuxcare.3" } ] }