{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5858f859-04d4-5d64-a1c8-dea91d15c44c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6", "version": "6.1.19-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:999b333a-1b97-58de-99bd-067d2c245f07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:c29c969f-7997-5de6-8204-6c23621115d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:80420997-6a75-5cdf-85f7-a3fa48bc0377", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:c7b25e49-db52-5a5c-b65e-5da746bfd3bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:f14bd2d5-aae5-50fc-bb10-9265f1bb9fb4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:ce2bc254-59e7-563c-ae9f-122577958d3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:44338d08-d27b-5f69-8b11-d196abaace68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:71901e01-635a-5099-9f71-d7457f0c6123", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:29b40007-98c9-5178-86ea-27465069e285", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:e92efb16-b54c-580c-bee2-b5f279f9c212", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:75cc50d5-2a01-583b-a02d-4b7e2b73818e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:804ad19e-d08d-5108-9a1f-88fc9f40f28d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:673105e9-765e-5dc9-8097-696930f424e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:f112aef9-db62-51e0-bbac-51acd815cb48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:f6ae9dbf-ce35-5080-aae2-6cc718591dfa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:b4515cac-6cb7-59c0-b30e-ed517708b10c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:108e4977-184b-5f84-bcd6-63ef2e02edc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:bd907c20-b182-5d59-af1d-0f9d38ccaca9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:e6a009c7-a583-5aa0-8f01-09ce5117fb62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:519a002f-5d09-5584-8b66-96fc30184a51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:de561e7f-f093-54b4-aeb2-a52330c8dee5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:d54674e2-b31a-5d86-baab-6ef5f7447e51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:344f21bc-e66b-544d-8c5d-d397ee53b58f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:58a01abd-2c0e-5288-b2c1-679908b59cbf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:ad2cda79-de2d-52b2-ac08-34819d9c143e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:688b68c8-39ed-5d1c-8613-612c22f5dd52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:d92005a9-248a-5d11-8cbf-5e027bfcfbbd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:916516fc-ee7f-5ee0-866d-1aedd9ccb628", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:4c75df52-aebb-57b8-8a1e-d93a72cc59dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:93e71d1c-e01f-5a43-9da6-0a5533dd0b22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:b28e1c56-9a2e-55b5-aad4-453cd342c68c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:a3fd9eb9-5148-534d-8a3e-3f0065b80f04", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.19-tuxcare.6 of org.springframework:spring-jms. Spring Framework 6.1.19 is not affected by CVE-2026-47890. The vulnerability targets SSE (Server-Sent Events) Fragment rendering, a feature introduced in version 6.2.0 (August 2024). Version 6.1.19 predates this feature entirely. The CVE explicitly lists affected versions as 6.2.0-6.2.19 and 7.0.0-7.0.8, confirming 6.1.x is outside the affected range. The vulnerable code paths (ViewResolutionResultHandler fragment formatting and ResponseBodyEmitterReturnValueHandler getFragmentContent method) do not exist in the target codebase.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:80b40d18-b112-5365-b95e-621dcde45592", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:51a02ca3-715e-5ee6-a11c-11c592da4a69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:d4e38b06-a2bb-5e8f-981d-14be590947e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:b013598c-6ad3-5b2b-bb98-bf6b8478370f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:66c0d7b9-5296-501e-958a-1165a8801d84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:66bdc356-831e-5971-baea-20798bc97a38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:60ff8ca5-9e9e-5b5c-b560-46f2f2533f16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:1602b9c7-c39e-5b5e-8f4d-84ef3ffb9df4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:13d4ed24-d9a8-5fd7-b6ab-3ee59c5bcfad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@6.1.19-tuxcare.6" } ] }