{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5c9f0b2a-4e42-52e6-bb82-2f14d7cbe5f4", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8", "type": "library", "group": "org.springframework", "name": "spring-jms", "version": "5.3.37-tuxcare.8", "purl": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:6c41cf42-127c-5688-9c8f-66f2501f1063", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:17d0ffe0-662d-533b-8c48-8a2370886e61", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:2556843b-bffd-5b34-ae3a-d163919e9b95", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:90fe3ad6-7f50-5106-b699-5985177f0943", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:08fc3e74-4877-5447-bfa6-315cf5736cf3", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:784f5591-6856-54b2-ad51-5f5a9fc2e66d", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:7b975011-254e-56f1-a40e-a9eafbd0b2a9", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9ab40924-3475-5f3c-a841-4186525219a7", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:9d7fe349-779c-5ca7-9e09-c63040ec210c", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:e7afb315-4712-551c-b2c0-f06e9dfa76bf", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3f77de33-6ce7-5bb5-97a4-d4e051802abf", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:6f592d48-52bb-5649-82c6-931478b7cb44", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c05c22c8-dcf5-566d-a103-42ecac6fb46c", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:404740d5-7217-5045-ba50-587385b842c3", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:426f9183-7e9e-5a7f-bf14-26e2a304a137", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:12fa12a9-dcc5-516f-8b55-2ba86c963fcf", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:073f0229-9dae-52f5-a353-8a079c48ffb6", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a4b5bf3b-875b-521e-90aa-e4051173c2f0", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:e9104345-2407-5c87-8765-b4a0cbfda20e", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.8 of org.springframework:spring-jms. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:fe1ac332-7e3f-5af1-ab57-6de3752422c3", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a6f26411-52f6-5190-8991-4aecc9e87084", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:d406d581-aa0a-584f-8d4d-18e205b125d4", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1c60914d-0db0-5401-bbb1-726184310736", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:b675d18e-7307-5227-9679-8a2bc7b48130", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:0be6337a-a21d-58ca-b849-cba0f011bc96", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c8652bcb-8ea3-5258-bca9-538ae592f023", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:a6e23f10-5f7e-59cc-8148-29de810d8376", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:fca414b6-13e5-5a96-9299-453b6d6dec8a", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.8 of org.springframework:spring-jms. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:23a265a9-da28-57ac-ac4e-e104a2b16ca3", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:01b23e9b-530e-5ab7-b24d-90e735dd8645", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:0ccba320-1607-54ce-9f0b-3f985b845023", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:dd610ebe-674f-5199-b300-ab9001ff033b", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:cf302e50-898a-558f-a1f2-95c444933a9f", "id": "CVE-2026-41854", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.8 of org.springframework:spring-jms. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:0ddb7640-b8f7-555d-9a29-938918dbe83f", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ea2f5bbb-d554-567c-995c-cfd591ae5bde", "id": "CVE-2026-47884", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:ffd22c6b-eb31-533c-86e9-3ee9784590d8", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:39ff9868-c682-5ed3-afe7-b64f0c7bc26c", "id": "CVE-2026-47887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:0d3366e5-6ec3-52c1-9ead-f39071b33aa0", "id": "CVE-2026-47888", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47888 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c55af3fa-971e-5acf-8e01-4dd2f7c241d1", "id": "CVE-2026-47891", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c621756f-a9a6-5301-ab3c-e309a7a0a6da", "id": "CVE-2026-47892", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47892 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:0a281a2d-a8ac-520b-be73-8e4c91b326a6", "id": "CVE-2026-47893", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47893 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:4275bef0-56bc-5020-b3c6-dd4f25e6ac63", "id": "CVE-2026-59280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:86a07621-41d5-5f94-8b17-b1c673d5ba67", "id": "CVE-2026-59281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:1c21aea0-658d-5314-94c8-55b3228f0a3c", "id": "CVE-2026-59282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:3284d37a-2330-5df9-aa17-79ef6d6403e7", "id": "CVE-2026-59283", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:c8b2569d-3114-5cf4-b000-1aa9cf3677a5", "id": "CVE-2026-59313", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59313 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }, { "bom-ref": "urn:uuid:b3de45df-e6a7-5f4a-9bf0-1819a736b39e", "id": "CVE-2026-59314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.3.37-tuxcare.8 of org.springframework:spring-jms." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jms@5.3.37-tuxcare.8" } ] }