{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1602bd07-0d5a-564c-a116-0a9f4a37f659", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7", "version": "6.1.4-tuxcare.7", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.1.4", "type": "library", "group": "org.springframework", "version": "6.1.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:a665f41d-17c8-5dc6-9284-fda5d2e0822c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:e2a7d58c-924c-53a4-931d-1ec74521c8f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:f014b4d3-81de-5601-a4c9-9c26e1de1849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:08fc0f2c-111d-5de9-a4f9-08674a2c19e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:30f9270f-a6da-57e5-8bbe-7a10727f3e06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:1b796c96-89d0-59b3-bda5-7ce39cf8ccd7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:2147ac56-c30a-5c64-830c-b0d23606cefa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:7c4c3b1c-741d-5d56-8e82-d329b6112864", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:901fa4dc-cb44-5d37-a79c-34b2bc90d90e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:bfda8813-2a7c-5a96-b2e3-63853663596f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-jms. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2018-1257. The vulnerability (DoS via malicious STOMP selector header causing regex/expression parsing exhaustion) was fixed in upstream Spring Framework 4.3.17 and 5.0.6 (April 2018). The fix - a null-check that skips selector expression parsing when the feature is disabled - is present in version 6.1.4. Additionally, as of Spring Framework 6.1, th...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:2e62298d-2e95-51c9-ba9a-789e2131439c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:f6c916f2-19e6-5d28-a4e7-04ba27b85a8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1270 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:1fc91f64-09e7-5e92-a581-081b90938a1a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:f6fbf8cb-08c4-5a33-952f-a2598a105ada", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2018-1275", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:8fb53558-4541-5513-b5c5-8a927916645c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1275 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:fa5238b6-c7e1-5940-9418-7ff2a50f29d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:d6ebaa50-eb5d-551d-ba56-c6871ed4d7ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:b5ce97f1-d988-5b23-b8bd-7c0a9b992783", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:e11318de-ee27-50f7-9a96-e0cd36349265", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-jms. Spring Framework 6.1.4 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:f7eaca10-9625-5203-bf57-45c2e899458c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.1.4-tuxcare.7 of org.springframework:spring-jms. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2022-22970. The fix was already present in the upstream Spring Framework 6.1.4 release that TuxCare onboarded. The vulnerability (DoS via data binding to dangerous read-only properties like AutoCloseable types and URL.content) was addressed in upstream commit 83186b689f11f5e6efe7ccc08fdeb92f66fcd583 by Juergen Hoeller on May 11, 2022, well before ve...", "justification": "code_not_present" } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:bf6a7e7f-d352-5cd1-9bd8-a4cc4d9a0b2f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:8ac59bee-9734-501f-a4c0-bbb52ea6c576", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:b8da1963-95cb-550c-b5d2-21b4b218fcf4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:bd091ffd-aedc-5c5d-a896-7eef9e53f80b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.1.4-tuxcare.7 of org.springframework:spring-jms, and is fixed in 6.1.4-tuxcare.8." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:d92103f4-1fde-51f2-8311-c928e109c6e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:6e7f4583-be57-5395-aebe-7c1a85c5480f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ], "bom-ref": "urn:uuid:abed5ea6-9ed8-5d56-a70e-356d46877174", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.4-tuxcare.7 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.4-tuxcare.7" } ] }