{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:387f01f5-a92b-50b6-9e4a-f4fae7fc1772", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5", "version": "6.0.12-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:4b911a2a-1bb2-5504-9fbb-e71b2fe22448", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:9706882c-e3f2-5602-8c34-a5127f466707", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:3339faa1-9fe0-5582-a3a3-a8ba3e31bd6d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:77f5eec9-d9e6-5ca3-913d-b0cd88bca184", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:36f31464-8188-58a5-9279-1e428255c702", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:84dcf3d9-53dd-5a18-8ab6-bd7789f64225", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:15398677-42b4-5dc1-b931-78d7287240d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:5d62bc37-e729-53ce-80bd-fc14814dd37c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:45a1c90e-420f-512d-bfdb-0867009c3cf4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:af943e94-e616-5601-b89d-ac2b274d56db", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.12-tuxcare.5 of org.springframework:spring-jms. not_affected \u2014 Spring Framework v6.0.12 is not affected by CVE-2018-1257. The vulnerability affected versions prior to 4.3.17 and 5.0.6, which lacked the ability to disable the SpEL-based selector feature in STOMP messaging. The fix (commit ff2228fdaf131d57b5c8c5918ee8d07c6dd9bbac, April 2018 by Rossen Stoyanchev) added a null check and the ability to set selectorHeaderName to null to disable selector parsing...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:c6600257-1314-5fae-93b4-5f89fd405e59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:a3dfda6e-f9ac-5d2f-924b-c0d294fd62bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:bbc9bb9f-b196-55a7-abaa-7da8d7fec3f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:1ced8990-be53-579e-9f95-6e01d8aa2e21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:199adcae-4236-5283-bea2-af1336695c6a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:846c25b1-9f0a-5558-a8c0-57ca39562518", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:4c35ef03-1417-5714-84fc-9e40ede959b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:510f74c1-4192-5dde-a801-7ad61d867076", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:60860e19-a73f-5210-8a76-c00bfc5018ee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.12-tuxcare.5 of org.springframework:spring-jms. Spring Framework 6.0.12 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:5e292f7f-4473-5709-aa2f-b197b5b18538", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.12-tuxcare.5 of org.springframework:spring-jms. not_affected \u2014 CVE-2022-22970 affects Spring Framework applications that use data binding with file upload types (MultipartFile/Part), causing DoS through resource exhaustion when introspection repeatedly calls expensive getters like getInputStream(). The fix excludes read-only properties returning AutoCloseable, ClassLoader, and ProtectionDomain types from JavaBean introspection. Target version 6.0.12 is NOT...", "justification": "code_not_present" } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:54e6bb22-9b44-5d83-9424-dddb4a145eaa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:6ef50138-4b7b-5cd9-8e55-ef84e45107a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:907d57d7-30f3-5fcb-aac4-fa7bb473a600", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jms, and is fixed in 6.0.12-tuxcare.6." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:9037d67f-72ff-581c-904a-97e8d4a6211d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.0.12-tuxcare.5 of org.springframework:spring-jms, and is fixed in 6.0.12-tuxcare.6." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:7efc53e9-95b4-5637-a989-dd091d7aa2da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:1b06ca35-4952-5be4-a7aa-beb3456efde8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:14e88df8-9447-5ccc-9275-af7a96888bee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.5" } ] }