{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3cfd82a6-8c99-5890-bc4a-d5897a54e318", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jms", "purl": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11", "version": "5.3.30-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5e77385a-2770-58ee-b517-0b65ca4f1ce7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.11 of org.springframework:spring-jms and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:34082c43-090c-5fa0-a696-6ab3782dbe09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:6433d774-8217-5794-9e7d-7e2f42d3a4a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:d601a859-68b4-5018-80dc-60b0f90f21f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:3cff9e74-9757-5607-97bd-366a7c622c79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:29fa4485-cfe7-5a15-9ebe-b77b33a50368", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:7bb0f58b-c5b4-5f33-abea-09bab66a2a5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1181ac12-2099-5586-bca5-057749bc6269", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:e2269f64-15e2-5b35-a8a6-0c6e26d8813d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:120261b1-79f5-5c9e-a7c0-e1eda00e3366", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:122ea4f6-280d-572a-a347-1b193380cc6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:0a5bc538-4cea-58a5-8734-9e4e8ac36434", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:eba1a6b9-1cbb-5148-80d8-dc1f450db80f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:a3d33217-38cf-555e-bc26-cb2ca014688c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:ae2fd5ac-d3bd-5f72-83a3-709386095bf9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:b361d7d5-8e84-51cb-96e3-9d90d28b27e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:ec0da81b-192c-529b-8f69-a6bc5bd0b730", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1a69ab5b-b09e-5bdd-80a7-2afb28b9b4a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:2f99fbcd-11dd-51fe-8458-d268d3e5f642", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:58249e23-a4de-5d17-a0d7-cb0b36cbeb16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:08eb9b7c-7e4f-5b02-9c87-273dee47b028", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:e7217e15-4383-5794-ad23-2f9025781b01", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.30-tuxcare.11 of org.springframework:spring-jms. already_fixed \u2014 The target repository Spring Framework 5.3.30-tuxcare.3 already contains both fixes for CVE-2026-41840. The identical patches were previously backported by TuxCare as part of CVE-2026-22740 (commits 1a619adbfb and ee9443b0bc, merged May 2026). Both doOnDiscard handlers are present in the current code: PartGenerator.java releases data buffers on discard, and MultipartHttpMessageReader.java delet...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f914bc2f-6121-55f5-a5ed-530539db70ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1c721d17-7d66-5ad2-9d8d-0081cdbab455", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:6b8c744d-a389-5651-8735-90b7df0bc7be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:964fbd60-751e-59f4-9919-597515f00805", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:6dab0adc-cae5-5b42-bcec-201a0b075e38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:9a85a3ca-1565-5ad7-821d-0270fc9c66fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:ab8aa747-fedf-515f-9d23-0c95995dd93d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:68bf93d6-a9ec-5626-a05f-a01bdfd047eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:28a7a8e5-73ae-5f24-beba-7382eaa97060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1e5dec0d-71db-5cfd-b518-f43fe6870040", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:b540c459-f1c5-5484-824d-8f051d86eae2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:7c357195-1e85-5e76-a19d-6213ea337e6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:b9d2718d-4b94-531e-bba4-5cc40e2b01a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:dd19d8c0-3fb9-5819-ac7a-e45afcef71e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f739aba6-92f1-55c7-8d27-2b921cf135ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f92455c1-48b6-5238-99cc-ee528ddb00f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:666e8f23-7be6-532f-b949-c063eb760793", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:2c823408-46ad-5371-affd-231de20d7c95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:992b453c-6c89-5da2-80c2-1521da61fd16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:be3cb8c7-9f28-5017-a2a0-17c4933d638b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:58d9926a-e469-5858-b276-f6d9ab5a83d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:b5e7e504-53df-5dfe-b530-e6243857a707", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:2b0049d1-65ee-5e60-9a71-1712834564b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5aec63c8-b75a-545b-9c29-4c572510c6c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5bb3c9d1-1a9b-53a3-b726-1731149644da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:3ba537ce-f4d8-53e0-899e-d9f620e12356", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:c6a071ad-be77-5cc9-bdfa-cb30867f29a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:c598d57c-58bf-53ca-9dbc-93b7f8ff7598", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-jms." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.30-tuxcare.11" } ] }