{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6007a5cb-6e0c-510e-8c14-24a6d0f165cb", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6", "version": "6.1.4-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.1.4", "type": "library", "group": "org.springframework", "version": "6.1.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:163f70f6-c831-502d-8568-9e0a568667a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:8d50fa83-4e32-5f07-9418-4a67116078ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:19c72b71-8fa5-56bd-84d2-20b9cbbed439", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:1ab84c94-15ca-5773-be3b-4b5da8403337", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:01be811c-fca7-5292-abbe-ac4c6844fdcb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:992f650d-7af9-5d15-b2d3-4ac0746b905f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:b8264312-ce25-56de-a76a-25db79a8489c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:eb123d6b-8c9d-50a4-b66d-50a5f6086f57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:f3a2a1ff-d89e-5b98-b36a-6e0141e0f601", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:48870300-944a-5095-8e15-642643a54479", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-jms. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2018-1257. The vulnerability (DoS via malicious STOMP selector header causing regex/expression parsing exhaustion) was fixed in upstream Spring Framework 4.3.17 and 5.0.6 (April 2018). The fix - a null-check that skips selector expression parsing when the feature is disabled - is present in version 6.1.4. Additionally, as of Spring Framework 6.1, th...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:a65964ff-1d73-5c54-83b7-fbd833a83a7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:6eb184a0-5f6b-54fb-b8f8-35d245a388e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:8c18ffbc-3993-52f8-b137-6816b5149db9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:fc9084d2-e8d7-51b9-b024-2b1a8e881629", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:1b45c6ff-2112-59c2-8965-9d119a3f818f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:f55aa61d-3cee-530d-8805-18d7ca4b104b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:2945dc88-7ef6-539e-b79f-c6129a86222d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:720510ce-af14-5fff-a27b-546063eb2cee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:803cda95-1066-5db4-b33c-617d3e5f03ed", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-jms. Spring Framework 6.1.4 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:e7703fcf-b042-5fd0-a3fb-63f1424ef9d1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-jms. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2022-22970. The fix was already present in the upstream Spring Framework 6.1.4 release that TuxCare onboarded. The vulnerability (DoS via data binding to dangerous read-only properties like AutoCloseable types and URL.content) was addressed in upstream commit 83186b689f11f5e6efe7ccc08fdeb92f66fcd583 by Juergen Hoeller on May 11, 2022, well before ve...", "justification": "code_not_present" } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:51fb48a3-90c4-56ac-8096-e5bf22665b6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:97a9e76e-c5b9-5453-86a2-fdf06a3f4b06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:64190a6c-d972-5f2a-b05e-2cdd096fb142", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:c38f0363-dbfc-5d80-99b1-b7d5d330f64d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.1.4-tuxcare.6 of org.springframework:spring-jms, and is fixed in 6.1.4-tuxcare.8." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:3ab8c1c8-f026-5252-a35a-ad440edc22f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:24769f60-ff20-58e0-adfd-0dc3e92a330e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:e9f0e7a2-7b3b-52c3-81cb-4740c681b5f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.6" } ] }