{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:77055df6-5215-542c-b70e-fe3f4fb4c464", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6", "version": "6.0.12-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:498c06e8-a0ca-5110-9566-59a3c671e612", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:433b1638-400e-54a1-87c1-c1692c7c256c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:69caccf3-a65e-58f8-9f76-826b7b33ecb8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4211cf5e-2103-512c-8166-e61075e3c140", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7ccbc50e-910f-53bf-b733-be2347174f45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:cab22d83-da4c-5fea-913d-47e9915084ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:923dcb9b-3fe9-52e6-9f9d-b6f3c2c23db4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b73d96e0-6c8d-5f6e-8ddc-9d627f481074", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b2d4036e-2ab0-534e-bac8-18a0193ab3ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b54b6bd7-fbb0-5752-8cc2-2876239cc219", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4edf6ded-5437-515b-a2d2-51eddded7d74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9c3203b3-fc68-501c-9cc2-b00a781c9f5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3b78a283-3f17-5299-92a5-6a6ac5cbfa1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9b37fea7-50d6-524e-ab78-8c775fdc098b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1cdbe31d-2bbe-5af9-8324-748738b6c39e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1268a0f0-ebec-5fd9-b1e1-11f6ce706062", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:cda98f3a-f2e5-5a1a-ac16-e6fecd333022", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:52f991b5-7f99-54c5-ab1a-3431d33c65df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:55e1a83b-267a-5b5c-881a-a7887567f9fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5a3fd701-dceb-5a99-b293-15f628879dc9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41839 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-jms. Current version of spring-framework is not affected by CVE-2026-41839 according to the vendor - https://spring.io/security/cve-2026-41839", "justification": "code_not_present" } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7454fba8-801a-5274-aa1b-f6fde7215449", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:fdb70102-7864-54cb-8bfb-5ef991efa99a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b7c53164-2f0e-50cc-b3ec-2cf5cc8716fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b60df52c-1ad2-5f86-b0d6-c4cae7d42353", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:ca7d2f6e-673d-5ff7-81b3-930f5a57a268", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:00f56b76-ccec-5399-ac57-e5aaaa8c4d86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:ca169a4e-2e3a-5a0d-a4ec-7992c81c9a6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7db2e14e-34c3-501d-9768-9aa446263d81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:15229741-c358-5ddc-baeb-93240837d548", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d66d8d69-1a52-5df6-8060-86ad14d6af35", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1ced8235-6461-5056-98cf-9bd469033871", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:56ee8cb9-1f5a-5d8d-ab1a-b602e0365009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2fc7ea9b-1a41-5965-aa66-533e8b132f3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:87e9eb26-c9cb-5fd7-818e-749815bbbf04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d3898145-1a26-5c12-aae6-c2e9dc329bc8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:6b1d8a16-5c23-5fa2-aa85-5ed413ba3ffe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:dfa11024-9f68-5e5d-b772-6631629010ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:738b47a5-2809-5acb-91f8-2b5c9de0cb15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:6e36cda9-5455-54cb-8be3-1df4c1d8e15d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-jms. Spring Framework 6.0.12 is not affected by CVE-2026-47890. The vulnerability concerns SSE stream corruption when rendering view fragments, a feature introduced in version 6.2.0. Version 6.0.12 does not contain the Fragment class, FragmentsRendering infrastructure, or the vulnerable SSE fragment formatting code. The affected code paths (ViewResolutionResultHandler.escapeSseFragment and ResponseBodyEmitterReturnValueHandler.getFragmentContent) do not exist in this version. While 6.0.12 does support basic SSE via SseEmitter, it already implements correct line-ending escaping in its writeStringData method (handling \\r, \\n, and \\r\\n properly).", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:cc3fbf95-a0c0-5dc6-b4f5-c80bb635368a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:aa5783db-c29d-51d8-aaa0-4a797fd4e81c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5a276c8a-680e-53fc-8762-7350ea3e4676", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:fd0ddf9d-e848-5774-96b3-a176eb2014f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d7897d35-96b4-5641-9875-b6435d617a5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4320d52b-eefb-5054-8569-00f5529d709e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:661ca72b-5eb5-5e45-a09e-a3b921dbf913", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:f46a4e8e-bcfa-53ea-b7d9-cc8f515c5a5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b891c7d7-d071-544b-a7ca-28166d96d638", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.12-tuxcare.6" } ] }