{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3fc40081-f28a-5c9a-aac2-26f95c5026c0",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@4.1.9.RELEASE-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@4.1.9.RELEASE-tuxcare.2",
      "version": "4.1.9.RELEASE-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@4.1.9.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.1.9.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.1.9.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0848b9ed-0035-5909-ac61-ff6fa93a3f55",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 4.1.9.RELEASE-tuxcare.2 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework version 4.1.9.RELEASE is not affected by CVE-2018-1270. The vulnerability exists in the selector header feature that uses SpEL expression evaluation, which was introduced in version 4.2.0.RC1. Version 4.1.9.RELEASE predates this feature and does not contain any of the vulnerable code paths.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.1.9.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ed34292b-02f0-5a6d-b604-ec20ef74322e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 4.1.9.RELEASE-tuxcare.2 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 4.1.9.RELEASE is not affected by CVE-2018-1275. The vulnerable selector expression feature that enables SpEL injection was introduced in Spring Framework 4.2. Version 4.1.9 predates this feature entirely and does not process subscription selector expressions.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.1.9.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7ada5c1c-5a7b-5889-8ac6-7f7e096b57d3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.1.9.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.1.9.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5926003a-cd39-5575-80bd-8baf7189bab0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 4.1.9.RELEASE-tuxcare.2 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.1.9.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@4.1.9.RELEASE-tuxcare.2"
    }
  ]
}