{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:44115e3e-ae54-5565-9e13-50bcc0bc79ab", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2", "version": "5.2.8.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:42da1c6d-885c-5fb8-a2d2-a0e6114765e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9df35eca-1d93-5dc9-84de-81d3a051eebe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5421 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f8049e0f-e3cd-54cd-89e2-e240456b5ceb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:72824cf2-3593-511a-b1ad-20fb60a0ad3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:579a6c96-6240-579c-8bda-10ceae17778d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6aeaeb5d-329b-5387-8fde-0160edb1cc20", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:002c75a7-1cc4-5ae1-a66f-fe02a84b6f79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9d4f3c90-07f3-5484-959d-d162cf001279", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:39c5cf49-5391-5db9-8f05-78ce3310d169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7b3d3afc-9352-51f0-b297-daaae360d8c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a634db88-5eca-58b4-83c5-da214e7adbc3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:69c22004-9a2c-5e09-a32e-59dd99614aa9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ffa56165-1a24-58b2-9308-9b001375e283", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d5b3eee9-3343-5776-a72d-c49f389843f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ae685dc9-c0f6-551d-8794-bef66235ad8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:89072994-2c97-522f-b05e-b9558fb916a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:be5426b9-a8f0-59e9-9240-48352067f27c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9e71ce2b-895c-553c-a274-67ca911171c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a25ac0e6-4c76-5cf5-9b14-f1a1d45b16e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7dc0150e-69a6-50cb-8ae3-5c01e44d4c77", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, a code pattern introduced by the CVE-2022-22968 fix in later versions (5.2.13+, 5.3.x+). Version 5.2.8.RELEASE (July 2020) predates that fix and uses case-sensitive direct matching without any toLowerCase() calls. The vulner...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a20308fc-befe-59a8-9ebe-2f6da3bc69b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:074ec1eb-991a-5c34-81ff-3a5fa80cae9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0443771f-c3a9-5228-a5c3-58420e75ceb2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms. not_affected \u2014 Version 5.2.8.RELEASE is not affected by CVE-2025-41234. The vulnerable code pattern (PRINTABLE BitSet without double-quote encoding) was introduced in version 6.0+ on Feb 1, 2023, approximately 2.5 years after 5.2.8.RELEASE was released (July 21, 2020). In 5.2.8, when using non-ASCII charsets, only the filename* parameter is output, and double-quotes are automatically percent-encoded because t...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:54ffb960-0d3a-53d5-b9e2-12b585a0c13f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a0f83e72-76ca-5bcd-adf7-163c9da54282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4751ea5b-f27e-5149-8ce7-ddbb8dd8b21b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8e131ed2-d944-5056-93fb-c675ebd04ecd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1e87df4d-6c29-524b-bdc9-4d4946ed5414", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:14dcb14e-faa5-5ebf-97e0-73a6f95cd011", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e3683c29-71c4-5ec1-a68c-8f64f6ef5350", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2102e31e-380c-599a-8cd6-1bb6936cadf4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:718a1916-a834-51de-911d-ffd097cd09ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8914ef87-fa85-54e0-bf09-5e58f1d62480", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f97940cc-151f-5f72-bd0a-e608ed3a29d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4c389d6c-5b4d-522f-b780-3d66ef3c70f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:79e6dcc5-9f85-5647-aae6-17e2016ee3bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3bdf4b0e-06bd-5e59-91cc-b8b1aefe6510", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8fdbeaaa-4b5f-5dca-ab40-8b9be92b5f71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0eb35a96-4b46-53dc-960f-952dd231c01a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:28cb8358-921d-56dd-8982-3c14a3649880", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0919f60c-c4a7-5381-94bb-9877f30eba41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:75978464-fb07-5edf-b698-697104f7ae13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1b96471c-d3d5-5e8a-a5ce-609b911eb5ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:70cff7e4-04df-52ff-a622-52781ddd2c30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:73b99d36-6aa1-5443-b492-cbadb69ac228", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7c81a809-404a-5278-9a2d-1832be65dec3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1fee4747-bcc8-52bf-93a5-35620cb4ec90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4ffc9e67-de4b-5440-aab7-68e00c98f9f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c10f70ab-d71a-5a6a-ba9c-f69867fd4ede", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a5ab490f-1217-576e-8fbc-a23e02164e8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4a6c894c-785b-53cc-ac75-fa3b1ff52d7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d09453ea-6751-5d6f-a742-7d696c225239", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3b35983c-5764-5acd-b323-289ea79407d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6ce60637-c0d1-50d5-8d45-3cb966c8fc70", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms. Spring Framework 5.2.8.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r and \\r\\n) in SSE view fragments, but the Fragment feature itself was introduced in Spring Framework 6.2.0 (July-August 2024), approximately 5 years after the 5.2.8 release. The target version does not contain the Fragment class, SseStreamHandler inner class, or any Fragment-SSE rendering code where the vulnerability would manifest. The vulnerable code pattern (text.replace(\"\\n\", \"\\ndata:\") in Fragment SSE formatting) does not exist in version 5.2.8.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6db35ab8-57cb-5c9e-a108-8c3aa00f50ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:160815d1-5e29-5389-ba7d-b90c92de6ce7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d63edc3d-f5a8-5cdc-8a14-755a2cdfe114", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ded67618-12b4-5154-bebb-a6402103b37d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f01b1a4f-699b-562b-b7a0-85c843eeda09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:73b2d9a8-e80b-5820-9555-f18d30894472", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:03f7046d-7e11-5d4e-ac07-2d9d80659f2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9159c9ea-96cc-551b-b0e3-6a346f4baeba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.2.8.RELEASE-tuxcare.2" } ] }