{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:713b0624-d02b-51c9-9a6c-0969c61a0e28", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11", "version": "6.0.23-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:5cc76655-9079-548e-af34-3193b1e9cfa2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:db60c990-5bd7-5c6b-a362-5d749e021aa6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:44710dc2-a567-5f82-bfd7-0fb5742d9d74", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:c71dffd1-2c3d-58a5-bc65-a1b4f90022ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:63f57c7b-586e-52c4-97f5-960cb0704d95", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:cf04e170-f7a7-53f5-9600-e3fdeb885425", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:0e297abb-939f-5887-95c6-b8a6ceddb8a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:649e8c84-ea05-5c2b-a985-b076c326979e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:2c2dd090-8b57-5aed-8b94-48e083d9efbc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:a94fb8c9-e4e9-5483-b05a-d9c2969e5895", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-jms. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions with unconditional STOMP selector header parsing vulnerable to ReDoS. The target (6.0.23) contains the upstream fix from commit ff2228fdaf by rstoyanchev@pivotal.io that adds the ability to disable selector parsing via setSelectorHeaderName(null) and guards parsing with a null check. This fix was already present in the upstream Spring Framework 6....", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:0a23a073-a954-5dcc-8b8a-e77a83a0dc0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:60f9a7e1-0350-5aba-aa19-3b8def12771d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:80338447-26b4-5233-93b3-13d2b51d4962", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:0c1278b3-2d33-5a0f-a7e6-e2dd2706b121", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:e1b2f845-eba8-5944-855d-c327e2d80aea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:c338fe49-6661-5ffd-8da6-c86b40fc5ee6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:8ad345d4-797b-5d1b-b19b-0b8a53daa8c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:99b83900-f053-5e1a-9665-f9c1fd710fac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:eaaca523-357a-5ab9-b422-0c1b5f5d363d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-jms. Spring Framework 6.0.23 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:4d0e6cf8-140c-5e6d-9891-b7ea123ed4ef", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-jms. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.0.23. The vulnerability allowed DoS through resource exhaustion when data binding MultipartFile/Part objects, caused by introspection of read-only properties with dangerous types (AutoCloseable, ClassLoader). The upstream fix was already included in the 6.0.23 release, introduced by Juergen Hoeller in commit 83186b689f11f5e6efe7ccc08fdeb92f66f...", "justification": "code_not_present" } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:6c7476af-326b-5555-9e45-bc41a72466a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:4c98199b-6fdb-5677-8f27-1dc6e515ade5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:09c932e8-6edb-5959-a81f-c4e1a94ca2a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:f55886ec-2a08-5f8b-92e3-ee42caf18da7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:a463be44-f8ff-5ef8-b93a-a2a6713755c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:181a64bd-974a-521b-b470-4b61a1f355a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:cb8904cd-9759-5e4c-8028-d988805d3bbc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.11" } ] }