{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:daf4bda9-777d-5a68-ac2d-139aa1f114d6",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@4.3.16.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@4.3.16.RELEASE-tuxcare.1",
      "version": "4.3.16.RELEASE-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@4.3.16.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.16.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.16.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6fa871fe-f439-5ea0-8a84-87c87c115b29",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 4.3.16.RELEASE-tuxcare.1 of org.springframework:spring-messaging. CVE-2018-1270 is not present in this Spring Framework 4.3.16.RELEASE target. The vulnerability involved using StandardEvaluationContext for evaluating user-controlled SpEL expressions in STOMP message selectors, enabling remote code execution. The target uses SimpleEvaluationContext (the fix) throughout, which restricts expression evaluation to controlled property accessors only. The fix commit (0009806debb578e884f6dc98bd1f2dc668020021) was authored by upstream Spring developer rstoyanchev@pivotal.io and was already included in the upstream 4.3.16.RELEASE that TuxCare onboarded.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.16.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:878335fb-fd65-5de2-9c54-450ecbb59da3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 4.3.16.RELEASE-tuxcare.1 of org.springframework:spring-messaging. CVE-2018-1275 is not present in Spring Framework 4.3.16.RELEASE. The vulnerability involved unsafe use of StandardEvaluationContext in STOMP message selector evaluation, which could lead to remote code execution. The upstream fix (commit 0009806debb578e884f6dc98bd1f2dc668020021) replaced StandardEvaluationContext with SimpleEvaluationContext to restrict SpEL expression evaluation. This fix was included in the upstream 4.3.16.RELEASE (April 9, 2018) before TuxCare onboarded the version. The target contains the safe implementation using SimpleEvaluationContext throughout.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.16.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9c81fab3-a9ab-556f-8331-1527df1d99d1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.16.RELEASE-tuxcare.1 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.16.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c0eac49a-fd68-55f8-84d4-de5c28cf523d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 4.3.16.RELEASE-tuxcare.1 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.3.16.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@4.3.16.RELEASE-tuxcare.1"
    }
  ]
}