{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e24a1634-ddac-5b77-8d91-911dd2d12106", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10", "version": "6.0.23-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:9d99a6c0-8e7e-54ff-a6f8-6040cefb2122", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.23-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:7b93afef-78b5-5f59-9604-e8a998660d63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.23-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:f8a43f8c-a477-53f8-a9f8-40e6527ed95a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.23-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:49dc204a-69e1-5f4c-a3bc-87a90e11f448", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.23-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:405d25c6-af14-5a83-a99d-e03e5e6e60d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.23-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:d3301eeb-b09a-51aa-a9b7-ddd60e5bd82c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.23-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:d22e9226-bb2e-5215-840c-b4eb2dc39efc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.23-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:b0d18d9a-2b6d-5ae2-baac-24af36a0ad68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.23-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:6672cfad-9054-5430-bdcd-388980c9393b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.23-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:c6d384aa-d6dc-5010-8da2-80db5f90b439", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-jms. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions with unconditional STOMP selector header parsing vulnerable to ReDoS. The target (6.0.23) contains the upstream fix from commit ff2228fdaf by rstoyanchev@pivotal.io that adds the ability to disable selector parsing via setSelectorHeaderName(null) and guards parsing with a null check. This fix was already present in the upstream Spring Framework 6....", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:a2b732a7-7dda-5726-a355-1a70c30c504a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.23-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:fa5afb62-c1f8-53a4-b872-f578aec726c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 6.0.23-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:ff18c78c-3d18-56be-9c84-ddb779effb2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.23-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:eae6ea0d-c18a-5bca-9744-c7ddfcd5e532", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.23-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:a52f60ce-8477-5e94-8151-cdf475d8cb1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 6.0.23-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:2fc05b24-9835-5a3a-a3e5-805f549f1014", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.23-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:e7795744-3d7e-54c6-b424-0b49175559da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.23-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:e1db2e48-0c64-5b31-95ff-9b9a4280d840", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.23-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:5edc5cfb-e655-55f6-ab45-e6afe372ea00", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-jms. Spring Framework 6.0.23 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:bd94c06f-5ff7-5dc6-8498-30a0b05096cd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-jms. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.0.23. The vulnerability allowed DoS through resource exhaustion when data binding MultipartFile/Part objects, caused by introspection of read-only properties with dangerous types (AutoCloseable, ClassLoader). The upstream fix was already included in the 6.0.23 release, introduced by Juergen Hoeller in commit 83186b689f11f5e6efe7ccc08fdeb92f66f...", "justification": "code_not_present" } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:31f424a3-86f4-5a10-8944-3bdd4b226138", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 6.0.23-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:eaad6b67-a12b-5a7c-9991-7793c467ad08", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.23-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:7aed1495-3e15-50f3-adff-6ede4ac5b7db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 6.0.23-tuxcare.10 of org.springframework:spring-jms, and is fixed in 6.0.23-tuxcare.11." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:e6c9b0c6-f26d-5d78-be00-dfc52e6c6e89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.0.23-tuxcare.10 of org.springframework:spring-jms, and is fixed in 6.0.23-tuxcare.11." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:d2daf0d9-9375-566a-8c45-5439523fd323", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:1eef7b4d-0975-5823-9646-0edd53ddb31b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:642a7652-52ab-51f2-996b-828f17ab58d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.10" } ] }