{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ec6d1cd4-01ba-5a06-9336-370a5949dc72",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15",
      "type": "library",
      "group": "org.springframework",
      "name": "spring-jms",
      "version": "5.3.39-tuxcare.15",
      "purl": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:a0dec9b2-e9ce-5514-b35e-42eee342af9f",
      "id": "CVE-2016-1000027",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b2c24856-4b9e-5131-85a1-b26a9bbd10ef",
      "id": "CVE-2022-22968",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22968 does not affect version 5.3.39-tuxcare.15 of org.springframework:spring-jms. Spring version 5.3.39 is not affected to CVE-2022-22968 as fix has been already already backported by the original developers"
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:de2e3878-03a7-5a47-aacb-6298c743d485",
      "id": "CVE-2024-38816",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a8cb0f94-11d7-57dd-a304-5274a6f1c275",
      "id": "CVE-2024-38819",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e7121f96-b66a-5b72-879a-fc46faed2793",
      "id": "CVE-2024-38820",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6c52a88d-d97d-5154-bbf5-3fd6231a44ca",
      "id": "CVE-2024-38828",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:19b8acd7-b3db-50ac-9875-0aef5a82d6b0",
      "id": "CVE-2025-22233",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:dda8a577-33d9-5508-a6d6-0acfee4861aa",
      "id": "CVE-2025-41234",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-jms 5.3.39-tuxcare.15."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2434948a-4a7d-5562-a6f0-d3c1e7862b4c",
      "id": "CVE-2025-41242",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5edf3e72-f4d5-5f68-9eec-320481f9b3fe",
      "id": "CVE-2025-41249",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:67de495f-bc7a-5fb9-bc9c-fa40548eb1a1",
      "id": "CVE-2025-41254",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d7035fa6-afe8-5bc6-98db-74d5ed7ca945",
      "id": "CVE-2026-22735",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cbe78113-7205-5c40-a8bd-6fe7f0574b0e",
      "id": "CVE-2026-22737",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b5d833b4-69eb-514d-bbc2-2666aa005f32",
      "id": "CVE-2026-22740",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fc20f084-9901-5b28-b68a-3b813180e168",
      "id": "CVE-2026-22741",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fd7484d2-876b-5066-9e1e-759a0d67923c",
      "id": "CVE-2026-22745",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1b1efca3-3c5a-528d-98d8-832a2e4783e2",
      "id": "CVE-2026-41838",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:842a6898-0991-5137-a609-9e52030dbb02",
      "id": "CVE-2026-41839",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a97db4e8-e116-5305-9ce3-59d0373a68c9",
      "id": "CVE-2026-41840",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.39-tuxcare.15 of org.springframework:spring-jms. already_fixed \u2014 The target Spring Framework 5.3.39-tuxcare.12 already contains both vendor fixes for CVE-2026-41840. The fixes were backported via commit 4ef4cdca34 (May 13, 2026) under CVE-2026-22740, but the code changes are identical to the upstream patches. Both doOnDiscard handlers are present and active in PartGenerator.java and MultipartHttpMessageReader.java, preventing memory exhaustion from unrelease..."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9d16ab1a-2402-507f-a1b0-1493fe1aa283",
      "id": "CVE-2026-41841",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41841 affects version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1f98d7f9-082e-5354-ba85-1ca53b73f91b",
      "id": "CVE-2026-41842",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f635962d-acea-51fd-a0c6-85bb85fe92d0",
      "id": "CVE-2026-41843",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b22a4175-e254-51ae-908e-44e216348781",
      "id": "CVE-2026-41844",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0d179b37-6275-5b6f-8382-5ad9b7caf3ea",
      "id": "CVE-2026-41845",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:31dc1002-0e41-5e72-a46d-82655f60eb16",
      "id": "CVE-2026-41846",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:675ed54d-207e-5f89-8011-fa66f3ea2868",
      "id": "CVE-2026-41847",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:fb2316db-416b-569b-81e2-7d0bb28fb387",
      "id": "CVE-2026-41848",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:953718a5-3a5c-5002-8fc2-6c5f9d066447",
      "id": "CVE-2026-41849",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41849 affects version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d3d13749-7404-5695-9971-3693e1ffc1e6",
      "id": "CVE-2026-41850",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5aa5014b-8590-53af-a0e4-d0804b4f887a",
      "id": "CVE-2026-41851",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:06cb6629-3b4e-5c46-a99e-46f374358245",
      "id": "CVE-2026-41852",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:105cc7dc-8d15-5c4a-a5dd-fc47fd20eae6",
      "id": "CVE-2026-41853",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41853 affects version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:aecda3e0-a49a-54d3-ab04-e94077086780",
      "id": "CVE-2026-41855",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41855 affects version 5.3.39-tuxcare.15 of org.springframework:spring-jms."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-jms@5.3.39-tuxcare.15"
    }
  ]
}