{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:68b94bfa-54de-516e-a643-638ba152d570",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-jms",
      "purl": "pkg:maven/org.springframework/spring-jms@3.0.5.RELEASE-tuxcare.12",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-jms@3.0.5.RELEASE-tuxcare.12",
      "version": "3.0.5.RELEASE-tuxcare.12",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-jms",
            "purl": "pkg:maven/org.springframework/spring-jms@3.0.5.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "3.0.5.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-41855",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-jms@3.0.5.RELEASE-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:72fd64a0-49bf-5e9c-b398-70b24714d4bb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41855 does not affect version 3.0.5.RELEASE-tuxcare.12 of org.springframework:spring-jms. not_affected \u2014 Spring Framework version 3.0.5 is not affected by CVE-2026-41855. The vulnerable JMS message converters (MappingJackson2MessageConverter and JacksonJsonMessageConverter) were introduced in Spring Framework 3.1.4 (December 2012), after version 3.0.5 was released (2010). The target version does not contain the code that reads class names from JMS message properties and uses them for dynamic class...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-jms@3.0.5.RELEASE-tuxcare.12"
    }
  ]
}