{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6120e85e-99e0-540e-8ed8-c7527485a4db", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13", "version": "5.3.37-tuxcare.13", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@5.3.37", "type": "library", "group": "org.springframework", "version": "5.3.37" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:cb626e92-10a4-5aec-bed5-1738e0f9c59c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.13 of org.springframework:spring-jms and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e0796779-7fc4-55ec-b65c-85ccde733c21", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:f071db63-f6cf-5ffd-9306-6d7518725cbf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1fcd4263-6182-58eb-a094-bbabd3299e71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:bdd4a0fa-33ca-515a-b331-bbb08b645ca1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:bb85c1b7-a09e-5766-9641-16e80eddae22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:4d183cdf-cf86-5124-aeea-953775036138", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:2fc72fce-758e-5c15-a8bf-38801a330601", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:6587254f-a419-58bb-8474-93674f2e0d32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:1c3f1d42-ccd3-58aa-a94d-b9b61db97bdb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:49340d90-2ee5-5a9f-8dd3-4b30df2131a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:08fbe3e2-80e9-5362-972e-6237f44f90d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:90d7f458-b2b6-5d7a-a67b-aabbd24cb46e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:d540ecb6-b539-5296-9fdf-1c87a5b6357f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:d6facd8c-f0e2-591b-a907-bc772304ec3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:98b10e08-d767-5f63-baa8-1543344e5fe6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:25b706ae-9743-5f0c-a0e7-52d38a061845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:0247bf82-9a51-53cc-9bc4-3e8a40a2f1d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:53aa2397-88d0-584f-a954-135ba5a1101b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-jms. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:108570f8-99af-5420-9f15-0b04e4b36c7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:21df1a29-e71c-5cc3-aba6-c4dec8e1e962", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:510c774f-f7f9-5d0a-8a0a-292223dfad91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:794e66e8-1295-5265-8f21-790da301ddaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:aa9eb1e5-90b4-52f2-bef4-8b3e2823afc6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:a7ff7aea-6920-52cb-9dd7-5b57e9865274", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:cd63752a-e5ae-541c-aec8-4cc519e0842a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:a8297893-a834-5e99-b155-c8021f64f218", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:0e7e3ad1-d75d-5f99-a41a-e4ef17460008", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-jms. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:8d2de746-5d49-56dd-b827-edef87059435", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:c082ceb8-8a1c-5a51-8b8d-260d7a63dce2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:b68813a5-04f8-5e6e-b030-459db5fc724d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:c1773e44-209b-5960-aed7-3c02f11cb631", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:a5591cf3-6cc3-524c-91db-94627ad25638", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-jms. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:52ac501d-c103-59bd-96e8-29ad59d5b7bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:99761ec8-1c04-5c22-adee-b3271db41521", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:982ef6b4-c842-5f51-9cef-23c6f4c14fee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:e6853076-ec23-57b0-8adb-5c93c3b20b62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:7c8b470a-d7dc-5b7c-be69-08260056603d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:cf1c6a25-0a9a-5835-b725-d5c6843cf665", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-jms. Spring Framework 5.3.37 is NOT affected by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) stream corruption when rendering view fragments, but the Fragment rendering feature does not exist in version 5.3.37. The Fragment API (Fragment.java, FragmentsRendering) was introduced in Spring Framework v6.2.0-M5 (July 2024), while version 5.3.37 predates this feature. The vulnerable code path (getFragmentContent() method with incomplete line-ending escaping) only exists in versions 6.2.0+ where Fragment support was added.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:cd9d6a97-43de-58dc-ab15-430846804541", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:72cd9640-b596-5401-af71-276d4be06dc5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:da012bc3-3109-5d79-9db0-aca04359b81e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:ae29592f-067c-5855-a8d7-993481a1d9eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:4e1ba408-d47e-5ef7-9766-df409bd6d996", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:bca8d009-310b-5068-ad32-9af69d455f5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:405ee635-460d-5a14-b304-b610b3930a57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:6c58a4e5-419d-59bd-aa90-dc8b17d4e520", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ], "bom-ref": "urn:uuid:4f81c6e0-3f3c-5b60-988c-c99d57031e01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.13" } ] }