{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a894308f-ba20-5e76-8ba6-68b76af1ae99", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "name": "spring-jms", "version": "5.2.13.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:c0d2dc29-507a-5457-abfd-f7e841029208", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:91a3f081-347f-51b4-849a-838e9e9ce246", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ada9f009-db54-5668-a18f-5fe93e6ce02b", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5d0130e9-e42b-5e37-98c1-c11a443c4492", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c847a1ff-40a4-5ede-a9b2-3a104c7f013d", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:286a057b-f2c1-53c5-a3f6-f54fdceb4d56", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2241aef9-514e-5fc7-8ee9-9555ff1255f5", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:12e614cb-fca7-5e0b-b148-868b1437ecdf", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9a96397e-d3a7-5d3c-b562-22a6bac7938f", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:867fdf61-b918-5540-8c4a-60ad8f75ef6e", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d64cb5f1-390a-5d09-80b2-5479455b4b5f", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:922548a2-b2e9-5220-8389-6d79e22c2cb4", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6d354ab3-d6f0-53c5-8ab9-a45c2c4db5b8", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7e12cef1-9958-5eaf-9831-b2e503b1b7cb", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2d8bc15c-9d82-5889-aeb5-f04767a6cd65", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5f606a5e-442b-5244-8bc3-d1a1bddc8afa", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cc8cd27e-fa44-54dd-a64e-d1e24962a89b", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cd75ae29-b7c4-54c4-9b8f-55a992b3ac3e", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f056a07e-05a3-5b36-a114-fb2d9b85baf8", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:08e13494-948e-5541-b826-2d7f39591e26", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:89d745a1-406b-51df-bb12-16fdb7101e35", "id": "CVE-2025-41234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a7bfbd0d-352a-5415-bbff-e24e7e038521", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6b916ca7-c25f-548c-9aae-5455b46ad7fd", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:6fbd152f-7c62-56e6-a48e-1c61231d4400", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a43ba7d1-8aa7-5127-ae13-e9f577dcad40", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:713add95-06d1-5e23-81ad-84e78e185fe0", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d02098e5-b9c1-54b2-8c95-0428d8151592", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d25befef-8b4b-5996-b08b-7d7651276ddb", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e3a6ca2e-a763-568b-9ea4-b740def14a40", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0a9b8afc-bd81-56e6-9972-5dd0499988b1", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:59e67109-f05e-5f7a-82d6-84e270a2fa5f", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1ac97ebf-fa8f-5f7b-b3b0-cec472357f5e", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c4d0ab3e-7c24-5c5d-93b8-371c46c4d7a7", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:aee84789-520b-59da-a274-de98d6c93583", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f27fc9f8-69d5-5f8f-92e4-7eaef9619f73", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0be6bfe5-02c4-5402-9914-5e0579f64548", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b2e68b5e-9f60-554f-8cc3-e7f6cb8ebef2", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c4139778-3f86-525d-b9f3-add21479e910", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b1f89940-da53-5fad-a87a-2c2f9bc24d4d", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d37237b3-0705-55ff-9b5f-31381bfed099", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fe7301ef-6239-5414-8f02-11158b83b13b", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9b121c96-62e8-5a85-9d28-3c6a65b5c223", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms. not_affected \u2014 Spring Framework version 5.2.13.RELEASE-tuxcare.4 is NOT affected by CVE-2026-41853. This version predates the affected version range (5.3.0+), and analysis indicates the vulnerability was likely introduced in changes made in version 5.3.0 or later." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:9019f3a9-e0a7-5167-bb99-8224ad2f2309", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.2.13.RELEASE-tuxcare.5 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.5" } ] }