{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:52adfd60-a033-5372-8e83-829b1aee1b09", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "name": "spring-jms", "version": "4.2.9.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:ef151fa0-12fa-52de-955d-6cce256e154c", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7b1643ef-53c1-5731-a5fb-2b8a35b3c61b", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:af87458a-3b40-5594-84ac-5b3639cf6626", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f0bc207b-3eda-5c53-832d-9293e4744ba5", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7991c97c-7222-5ef0-802b-8a84f141273a", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d2aadbf0-0271-5d98-810e-5ad5005c7938", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a13d0ff5-cbfd-5ad4-abfb-2248f173c60d", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:92710e2b-073e-588f-85b6-7b0d30f64f78", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fcb13f5e-09d8-5944-8b3c-dcd994350186", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:464df6c6-9534-5a6b-83d3-325e6349c8a9", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a57d19cc-fa40-5c47-b86a-cdd5466947e1", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d209db4b-8614-57f1-b790-53a98e12a8d9", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:78324523-a496-5ab3-9989-5f49f8645d7b", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:684dc4eb-4502-52c6-bf85-205cf92705ff", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:908d1fb1-2de1-532e-8ddb-f5b0f3fac042", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:80c6e1f7-1a9b-5b10-b308-ac865159b0b3", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4b3cc42d-f6b0-5174-bc77-bad72e752cba", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d009b9ab-fc5d-5b1a-a7a4-a544109fbe1c", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fc9ccf9b-da3b-558b-8057-db2eebc813a0", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ba40f2b1-e36d-5b4e-ad58-d91fd973ed1e", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8b61a06e-820e-54e0-a8d5-604f9a1dc238", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:11cb7945-69f6-5b46-a795-e0a04280729d", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e7c0813b-1215-533f-80f3-d03b42495abb", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:43dbde28-c525-512e-892f-ab7f1f33dcc4", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:43a36cb0-75dd-5b09-ba44-fde9cb5af3ff", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f82dfbbe-dda4-55af-9b42-683bf2deb7f6", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:63d7aa82-23b3-5d8c-8caf-3ba9c4ba7fc0", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:29d793fa-7999-5a27-b36b-232a6f7f9722", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ef3d2cf5-12ff-507a-9254-b5ef859ad80a", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2149ef5c-f75a-50c5-b3ff-87e4e169f4b0", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:66b7fc42-2d80-5c3d-bcbc-973fff03b680", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:917dd235-1c4f-5bfb-b65e-544d5e0e4a0f", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7b95d4e8-096a-5945-b0da-a8979728c58e", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7766911f-40e4-56df-ad40-8b81e4ea53c5", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:268d1768-fc58-5dc5-8af0-0674c20e1e74", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e9b39fbc-6ac8-52d3-85ca-5695774eb86e", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:aad924cd-3f91-530a-b8d5-32c0ef8c9296", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b67dfa44-2250-5f52-a7a7-da660f7d8602", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:04e7583e-1eb3-510a-954e-a847d6fd315f", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:8fd505bf-149c-5047-a2ce-461691ccd6d5", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6185a990-27ed-5a9e-9fd9-24957f55cc64", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:950d4b3f-cd2b-5197-9996-7e472a8d06ff", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3fe80fcf-fdc5-57cb-aae1-715c0070f458", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d3b2f032-d0b2-5ee3-807d-d7d8dfbd8c4c", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4b1ba855-9289-5f01-82f9-c6bb83fd5135", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:93a45ddc-30f3-5cdd-b878-02319ccbd8a3", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@4.2.9.RELEASE-tuxcare.5" } ] }