{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:013df475-f1f4-568c-bb6c-81b74cf56159", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2", "version": "5.3.5-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@5.3.5", "type": "library", "group": "org.springframework", "version": "5.3.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:d99afa84-1ab8-55ef-abc6-051d5f3f55dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:2cad49e3-1421-57c1-aecf-153be219d9a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:8f67da3c-c346-5c35-9c95-9c0a4c9ff3d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:13cadace-ddf6-5f54-9350-8744d560a19c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:e9f98b31-6688-5a95-b874-e970d55bf5d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:735c2d3d-b8f2-53e1-96cf-c916cdf9651a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:c16a17ff-3d3a-5217-9e2e-97b505010c41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:b7d8a65d-c45f-5773-94db-42ac9934e5f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:619b4e7e-601c-5add-b00f-7aab4c3343aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:710c9134-910d-526a-86ca-0dd3b0f81ce0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.5-tuxcare.2 of org.springframework:spring-jms. not_affected \u2014 CVE-2018-1257 is NOT present in Spring Framework 5.3.5. The vulnerability involved unguarded Spring EL expression parsing of user-controlled selector headers in STOMP messaging, which could lead to ReDoS attacks. The upstream fix (adding null-check guards and the ability to disable the selector feature) was applied in April 2018 and shipped in the upstream Spring Framework 5.3.5 release that Tu...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:c65dc885-fc1d-5988-af48-da69d84c54d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:de95fd0d-2b12-5bfd-8208-c450d2365cb2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:9ecd5f48-d77c-592d-8d2c-94f9770a127e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:91bcc805-230c-5174-a109-bb720527dd58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:3808f02f-9da9-50ec-a817-9e4e333c8afd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:fb94eaeb-48dd-59b1-97f2-fd833cf830b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:c8732134-ee90-553a-aea1-7d8d1fbf3db5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:1f5c27d2-ca30-5a71-958f-7b0aa9ec3ee9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:c6c76cb2-a945-5648-93f2-781b283021b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:d64aec55-927b-5845-8d6a-c4d782783697", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:2caeeceb-e5b9-5772-8b39-8a5adbb50096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:9a8fa976-f573-5786-8f4f-f18f2ac2623d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:942882c9-94d0-5331-a6f5-7531865f40f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:45bb2f02-d4a5-5af7-affc-4862c4c2b244", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:5b311003-a8c2-5689-938b-aab674e84fc9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:380f1679-86c6-5896-9a4e-9d8336eb8c6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ], "bom-ref": "urn:uuid:26f0f9de-ff4b-54c6-9883-960b91e86299", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.5-tuxcare.2 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.5-tuxcare.2" } ] }