{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5a132e03-032f-5509-83c8-c5d00ca56762", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-jms", "version": "5.2.13.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:d5d4727c-fdd0-5511-9190-d80fc5b02119", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8e80db96-9cdf-5d1b-b21c-85d036f6ff22", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c948bc98-4bd2-55ae-9f7e-93b9e8586c90", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ca56ab01-c9e8-51d3-902d-d06ca46c4b7e", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b8d349d0-d48e-5bd7-9142-29c2cc333da1", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a6aac672-a39d-5c8b-935b-3bafcbad81dc", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:99b544ab-650a-50a3-b3ba-da670dc86eb6", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:de5aa8d4-502b-5eac-8859-8d38374e48bb", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c86dc711-d0d4-59f4-99fe-77759888f2fa", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d734f56a-24e1-550b-b66d-843c0e185d98", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:84722527-358e-5e79-9753-a6bac86c34fa", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0497cd14-7612-55fd-b2b2-fe11a56a78d9", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:51117916-9f01-50a7-9183-55877a7b7ee3", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:adea3c3c-177b-5484-85ac-a580bab9cee4", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:48c7ec15-30b4-5c51-a1c6-8646bb912337", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:83e26242-f316-5cfd-81d2-3f7bcdd8fecb", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2c3b8c40-d4aa-5cea-b481-ffbc7343dccd", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fc1913cb-5541-5d86-97b5-5639c1a8c850", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:51237d27-7bbd-50ea-9623-b43d55ebeba5", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:493a193a-de97-55a0-95ed-12f4f1df3b20", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:db800467-fee7-5463-8b59-f581fca7105a", "id": "CVE-2025-41234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:95085598-b669-5b1a-9863-56f981aeff32", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3e30e2f3-33e2-5ce4-9c73-a8c641c778ba", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:17706c40-3a48-506d-b4ba-ddedc29c1db7", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b30f46f4-4f5d-5a61-be3e-f92a2b359923", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:371e2199-891e-5524-a5c4-0ca46d2fddff", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:56a0b4f0-31f3-5598-a1d2-365aead78b53", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b0a3e144-56c5-53df-822d-36261bc38376", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bdbeea99-b505-5e3f-8e24-d4befe6d9ae9", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:af761df0-febf-5491-91a6-f2bea7d959ec", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:42d4ebdb-9f0b-5d0a-87a6-26b7e5e1c2dd", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:18f7d288-c6f6-5a17-a049-c06686acff20", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:46879a5a-0da0-559b-8612-bcaba18870ac", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d7bb32b9-42ef-5a4c-841d-d159439c29b3", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:887e9f92-26a8-555f-91f8-08dce97d4485", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5e35dda9-1ae2-5f42-b34c-29d439e29009", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8674a9f1-9d76-5694-9cec-93c973d20186", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:15af4f19-127f-5042-85d9-5cff1cadc55b", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:70ddac18-581d-56f4-83a1-e2e735c00a64", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:52851342-221f-5c44-8ac9-a86a1f13d9bf", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a90785e0-3ae2-563b-83a5-4d78c00f512b", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:199b2e8a-7fd6-5a37-b7ec-b83197c6f4ec", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms. not_affected \u2014 Spring Framework version 5.2.13.RELEASE-tuxcare.4 is NOT affected by CVE-2026-41853. This version predates the affected version range (5.3.0+), and analysis indicates the vulnerability was likely introduced in changes made in version 5.3.0 or later." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4c0cc294-a804-52ef-a18a-b09e5c75a625", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.13.RELEASE-tuxcare.6" } ] }