{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e79f9d6a-f621-5fbc-b13f-eeed94911143", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10", "version": "6.0.16-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:488ff329-96a8-5d1f-a871-80494b12e95a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:80cdda83-68bb-54e5-9050-d53ff16d26ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e61664ef-ad23-5426-bdcf-0fad39d5b87b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:918b8438-72e7-5710-90cd-d944631e2c85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:76951a3e-34ff-5f68-bb4a-5cebec251a68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:108554b2-9ce1-5b96-bfec-38461779ca24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:42a8089a-b270-536a-82ea-c8f90d6ee524", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9a11cb78-d1f8-5299-9850-8bcd5f01d324", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:edde90de-fbd3-5b58-bff4-ccb578775465", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:8b972c7e-fe3e-5ed1-ac4c-4cd05fd3466e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9e300ad3-c960-5b1e-9f74-b1ae97e31e49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:44dc260f-188d-56c3-b459-0fd146822dca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9a234ba7-afbd-5a0f-b83e-8b95ad3e6b6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1dcfd0e2-4322-5362-9d50-8192b57e2f05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:53d87d4b-acf8-5bcf-8785-51001a8ccc67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c0689725-3142-5930-947b-d83f2ad7a058", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:8ad1f6ba-78b1-5dc1-8219-17e2648a74a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:afb31f1f-7fbc-57d9-966b-0184eda60170", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4fb8b5b3-59aa-567e-92aa-5811f6fc8a43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1f1942bc-bd5c-52cc-93af-00de46909d75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:0e65c721-4515-5be3-bc2b-48c3722653e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:862d4a1a-8fb3-51b2-b823-cc8fa346d676", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9d4b8979-4bfc-5214-bd8d-679524c6cddb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:00bc62c7-597b-5778-a25d-5f2003515fca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:dffebf72-856b-569e-bdfe-cd49e6ce59f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6ca4c156-c6c5-5bf7-b3ee-756289882376", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1a59afa3-c6f0-5eed-b491-23fcb486a9e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:205b733c-81f1-50e2-98be-73bc380425fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6b818c2b-882f-52d1-9f7e-692535142845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ff4dffd3-b444-5a93-a7e9-8a9128d220d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:dd0d58a6-b5f4-5f87-be68-ab69f09b5367", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:8c075ebb-4d97-5ba8-afcf-f37edd8c3df9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6aa45d24-33e8-5978-ac49-3fdb44e66490", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:504bb47b-43d9-5196-b369-ac43b1809d7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c590d263-9271-52b2-9027-498c5bd99b51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:79691b52-6504-59a0-9e41-7d58c1debc6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:117f731c-8317-57eb-9f3a-ade4e46191ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:5134924a-8cfa-5dfe-914d-6678621424cf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-jms. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e29c087d-923b-5677-b10f-20055c4275d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:05f6226c-1536-5b8c-b11c-b1157857757c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:0956c14e-6194-5acd-a812-e73d9baae697", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c546a671-409b-5242-b3f2-33d946e05f65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1a1c3de1-33a1-53e2-8f66-56f402ccba61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:0f10df71-ab80-5440-9aea-198a96f468fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:27c73a59-e324-5268-81e0-3212a497a772", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:5fe273b9-0101-5132-9eea-7478ef8f1c3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e7f5dccc-1a55-5827-9b9f-40f2eaa4020a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.16-tuxcare.10" } ] }