{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7c59d493-1d32-5684-b64c-af06eb297b96", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11", "version": "5.3.29-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ec5fe47d-2550-5176-ae84-e33b5c7edcf2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.29-tuxcare.11 of org.springframework:spring-jms and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:cfafef05-d452-5876-9f00-98b555237da8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:3292bd12-6a10-5afd-bbea-343b2fa5cf68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:e9b21859-585f-5ea5-bae0-27e17ea6816c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:df2545ab-7bd6-503f-ae41-504cbd016096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:471ab766-ca5f-50f0-bb44-36cfb294efd4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:5e013bda-23e2-5c95-a17b-43376bf25bf4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ded9fc4d-b242-5abc-b0c4-c7e6f7e49513", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:68fd93b5-dd74-5b43-b8aa-292d75d6007b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f0853c76-5ac6-5917-8f49-7491d4d7cf5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:3ee592c2-4344-52b0-8629-5e659860db94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:5b7e7c4a-66f9-5f6c-8384-aea496b6365a", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-jms 5.3.29-tuxcare.11." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:42510c09-4d61-571d-84f1-22b48cefad6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ca4e888f-7d05-5667-a1db-be079f1e5535", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:93f994fa-c8db-562d-82c7-385afc29d393", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6327f65a-dbd3-556f-81b8-35461771cefc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:dbd9c8b1-d689-50e9-869b-cdc8cdc5e459", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:5b0a3cbf-bb10-563d-b46a-33904d52c497", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:08cd0a87-0ab5-5fa2-b7e8-36e0731bbb9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bb46f7dc-c37a-559b-9565-ba4d13ff27b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6b43647d-9bf3-5b14-b368-ed75cfe2033a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9e3f8783-c631-5d33-93c8-bff2a5b37d00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8bbb5ef6-ed14-51a8-a04d-c13bed204c66", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-jms. already_fixed \u2014 The target repository (Spring Framework 5.3.29-tuxcare.4) already contains the complete fix for CVE-2026-41840. The fix was applied on 2026-05-19 as part of a TuxCare backport for CVE-2026-22740 (commit bc0026ae70c), which addresses the same multipart request DoS vulnerability with identical code changes.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d12f3e61-cadb-532a-a52c-383c15c588c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2cabe547-05dd-5f6c-832c-904ebbc65f49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:29e7347b-2215-5ab0-a6e0-7f11138baef4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:dc1ad371-1e10-53ee-b935-9949606a1326", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:63f98815-0fb6-58d6-9d97-e1a0b22c02dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:eeeae398-10e9-5478-b2b6-dbc1ffd209ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:37c73418-936d-5fc3-b9d0-3e385214b9d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9c27eba7-cce5-5ddd-8e94-aac770670d45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:370c12c6-07ec-5ce3-9f0f-6bde637ce59e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ab6236c3-db4f-5855-9477-e8664b349433", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0d4ec5dd-6fcc-5404-9d1e-c85d8b42965b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bc4ae76c-4ca3-5fd2-90c9-41ba9d29520a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c90af09e-c06c-5abd-9072-14520db5ea44", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:318816a0-9f01-51b3-a125-82d6602001f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2a59a831-a6a2-533a-a58c-661a28297947", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:13dbab0f-2c37-5561-943b-cf825c22026c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1633840a-3a66-5842-9926-03105413d7c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:37ab4770-0456-55df-a057-8585b9891b2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c1d98b95-fb27-5eee-bbf9-f3d992acd132", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f250b9ce-07bc-52d2-b6ea-9e0a16d13140", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c87c1d4f-a67a-5ad5-bb98-3ffa7b19c389", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c9efd85f-ef18-524a-8bf6-8570a5b194c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d942e398-5918-5500-bcbc-abde1980fa44", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2f1f2b3c-ec7c-537b-aaa1-7fa9000fd689", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6f9bc193-6a7d-5c94-8b8d-90ce4faa18cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ed2fd1c8-5bdd-54ec-86cd-fd0f82111a9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bcd320a1-47b8-5cd9-93eb-99a9a3d537ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6ddf8374-ccbc-51ce-bbf2-7b591440189d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.29-tuxcare.11" } ] }