{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8ad98742-9ff4-53b6-b788-9336ffaec02e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12", "version": "6.0.23-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:0a092c7a-c23c-5dec-9d37-c7fda668f319", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:bfcf89ec-3acb-5e4e-939a-2975251d3db9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:166c3d05-864d-5d9a-a23f-bd2902e59bf1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:521ac7ba-31ac-57a6-a24f-d8daec29975e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:daa3e849-4ef6-5f2a-ac07-a573ec96f837", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:6055bf32-a830-5382-9f8c-f8b375bafc18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:59603997-c63f-5174-8e39-17e90e55e1ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:37337bf9-9134-5f92-98e5-10e733429f11", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:bb191731-de65-5659-a8fa-0f3b859955a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:4b77778a-1668-54db-b75e-9a53f8d959c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:87ca97ec-3333-5831-9997-ea95d59a0eaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:cae90409-84b6-52dd-9ed2-c8a31d815e18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:dac3ce59-5087-58fd-8e96-01447836e5a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:a33de277-9fba-5203-9ae3-cf27728778d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:eef99db9-c286-5657-81aa-24439afe3ced", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:7d6c47d3-6d4d-5c0f-a508-7629742458ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:760c5d22-1631-5f00-92bb-9eb0d4fa9cd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:72495d0b-e36b-51c4-bb62-c3771642cfbe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:7b066798-36d5-5fe2-bddf-f64d85160de0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b09abc23-a2c3-5d89-bb2e-4e390ec9e9ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:81d1547a-8604-507a-963f-e5797e24bb07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:6ec34ed1-9a8d-5926-a73a-9ea21978a863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:0fec2762-b84b-5841-8fa6-bb23bce85598", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:59710b58-b7e9-540f-97ec-7e5da9b6b0ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:97d4d323-10ca-5908-b263-935ebb710032", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:cc3dfffe-3c10-59dd-a544-cd4f60343f69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:3e195568-e462-5fb7-8e07-158c91bee872", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:a684e37d-971a-55d5-a6e7-5717bd401ce7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1b16cc30-8aa3-5760-af8b-5ead699b3aec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:8ff839e8-fe50-5210-b900-2aec62cbcdef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:2f918571-9e40-5bb0-a953-4c0c639f0697", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:85af3c40-b0f9-59a5-ad46-5d67eb01eb02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:6e1e884d-f194-53b2-bf9b-f52b1b2db937", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:7e76ac11-e6b0-5cb9-99bc-3eea705d4954", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-jms. Spring Framework 6.0.23 is not affected by CVE-2026-47890. The vulnerability is specific to the Fragment rendering feature for Server-Sent Events, which was introduced in Spring Framework 6.2.0 (commit 622c1b9e8c, August 2024). This feature does not exist in version 6.0.23, therefore the vulnerable code pattern cannot be present.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f52a9648-ff86-5626-ab89-5ac31fb03d39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:42282438-b983-57b3-bc1a-9e66f6d1cf16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:c9c6dd4d-5062-51e6-b95f-3527102916eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ec3cea9f-3fc9-5a00-a1d8-bef7a7582a4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1586a92d-4e60-590c-8830-c78b884498f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:e4bb46fd-a6ca-5b7e-a8b1-69a86162e235", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:05a55b59-4b36-555c-b2c0-ff3ae4467f29", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ed195acf-f4ae-5cec-939c-141690e94d38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:20182c7d-13f8-50be-840e-01e8f0671aed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.0.23-tuxcare.12" } ] }