{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0067dc12-c4aa-529b-b26f-b76490877003", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9", "type": "library", "group": "org.springframework", "name": "spring-jms", "version": "5.3.37-tuxcare.9", "purl": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:95ed45df-c60b-5be4-bd64-fb48d967b20d", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:e9fee984-05a7-5893-8d16-522e073eb35c", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:2d113dd7-7707-591b-a2b3-789a421068cf", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:c1c55a75-5cab-5752-89ae-44fe27464917", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:6fcf5bac-d403-5baa-a9cc-a20b79cd5f07", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:b080514b-bfae-5f71-8bf6-390bbdfa3871", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:e5c1f3b5-c166-5d34-809f-7f9c417e3db7", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:3c0dd76e-6dc5-566d-b438-a1b4fd74aae0", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:85a8238a-e95f-5146-98da-35c0df74fc38", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:10deb84d-3187-5d5f-b397-7300e7f34117", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:e3495920-eec7-5d6e-9d10-7811a9a19f36", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:e546370c-cd5c-54fb-9ad0-6c4ba610839b", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:887409eb-9cf7-55d3-a2fe-20a6b0781329", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:d59b04ca-b073-5013-ac61-ce74642fc64b", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:5329bf5d-c260-5a5e-9aac-41d4e0211af2", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:a34da085-be77-5400-889d-c438fd6f9c08", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:6bfdeb1b-c154-53b5-b9dd-eda00f5fefff", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:291ec9b5-2c28-5cb3-9bba-4d6a2fde1fe5", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:ebdf3b76-2a95-5267-b489-f51958f103c4", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.9 of org.springframework:spring-jms. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:321a232c-45de-50b3-b553-a9aee729e68a", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:ab2830d3-c42c-5cc6-952d-4a61e512be86", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:d17f0b16-7043-5977-951b-117e7fba9470", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:85338695-44e9-5d8e-91bd-b74f347de888", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:5995d70b-cef9-55b9-b356-ee1057003677", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:e10bf384-290e-56a2-ba9f-33c6647f540f", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:3cfef2d6-2d9c-5ec3-a580-b21828b3689d", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:ae59ba7d-1f52-586b-a170-42e82f539a0d", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:475eb253-f93f-5ab7-9b36-bd0c5ae632f5", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.9 of org.springframework:spring-jms. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:652ec7b7-8860-5a80-a5ed-2c8040947d1b", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:d7579562-2938-549d-997d-46dc8c70f656", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:17d19a5a-98a1-51f3-9188-6423dae4cf3f", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:dd04a85b-54f0-561b-839f-429e708e5339", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:0295d71f-972e-571d-bec3-f44609a674e7", "id": "CVE-2026-41854", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.9 of org.springframework:spring-jms. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }, { "bom-ref": "urn:uuid:4a8c371d-76da-56c5-8cb5-13cd95325734", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.9 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.9" } ] }