{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9dee906c-f99d-5fd5-ac54-0ebafe30b67d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10", "version": "5.3.27-tuxcare.10", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:7b29b895-06c9-50a3-b9be-826501e82533", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.10 of org.springframework:spring-jms and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:2f7c883f-242b-54f6-89f5-f362c329adc8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0ec2ceef-40c5-510c-8a2b-c71ed565f1f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0175936f-01b4-51b6-bfbe-0d217eafba14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:71c6bb2d-a495-50f4-9e4e-0f44015528c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:40f0b5b2-98ba-560f-ada3-31787f2b260f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c82384f2-a608-5511-b623-38fdef2a983b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d4777dca-77e8-5636-b035-c58da28af8b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:aa479367-e6d7-5d9a-955e-c295aeafcd6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:8a9cd324-4d2c-54da-829b-d5ee06daec0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a026f229-b36b-52b9-ba30-8b1cba71c086", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:20fa6198-5e6f-5bc6-b4ad-9742f903cf9e", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-jms 5.3.27-tuxcare.10." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:e41cecd2-1748-5e68-9549-95d3443ee406", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:21d0365c-e150-5aaa-9624-f4dacb9a54f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:6fed32cf-e753-584d-8143-f5b666090842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:3fb24d09-cbdd-5815-b7c6-ae8f0421fdb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:18b2e1ec-35e4-5db3-9ee8-68b5e90d1eba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b17c9544-f867-5869-919b-40cac4c447df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f4366523-7f4b-59a3-9f7f-05833564a801", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:283747fe-b701-5706-a58e-01f81461b410", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5df4ee2f-04a1-5650-baf6-b47596c1d075", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b8122a7c-1d1a-5baa-9326-6f6b901a4ea3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c6af8a5e-e563-524d-9c99-44c4b2f587c5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-jms. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:53201e5c-c2e6-513d-9a3f-bc9378ea99bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f6d27068-34f5-580f-903b-e4a325288f16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:15bab9a6-ebd2-5535-ae1f-2bffcc6d0303", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:379393d1-4018-598e-b29a-90583528e3c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:a3af91a6-6b00-517d-8283-527f64ecc969", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5c36de1e-bf79-5693-98aa-3e29efb3a6cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f950db4f-b83c-557a-90c0-1ac9fe409496", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-jms. All 1 patch commits already exist in target branch", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:cbf6dd9a-47fb-5b0d-9070-d53aeea02dbf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:b9294a0b-ac29-5ce0-b2cc-4b64c2a13551", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9357a4fa-7583-58a5-bbda-0cba1c8feed3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:d2661f82-8c0a-5da5-904b-d9d10e89ac4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:f78a9ada-2c40-5449-91bd-92c921bc1357", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c0cc2ec7-53cc-5286-b3d2-3433ba0dc95e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:8f04ae7e-4714-57e8-a3f8-89df7f58fe9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:5b952369-ad65-553f-944c-1b281ee581a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:219c993c-6200-532e-ba20-0a2bac77fc95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:7b258252-fee7-5a22-8018-4c745df1aa94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:1fa123cd-dda0-5b4f-847f-0e2ba6169710", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:bed9c93a-9126-596c-b0c8-70e6e0eadbc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:102906c5-c809-57e9-ba65-dc5930403491", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:398e5e4f-d837-5982-b159-3855d30376ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:7fbbdee5-b5f3-55c9-97bc-2747c499dc0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:0ec23b9f-1853-546d-850a-b6c55766d83b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:9763696a-356e-557e-9076-12c9ed8884fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:c23ed311-9c63-5685-a522-90db07b20e5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:6d04013f-0d32-5074-9633-46b0b4174976", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:7962f0d7-4857-517f-bc10-272926db4b06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ], "bom-ref": "urn:uuid:051ba3eb-d78c-52b1-b625-9d1dffc74728", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.27-tuxcare.10" } ] }