{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ce6e7159-48b7-5490-9ed7-ea946e34c96f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2",
      "version": "4.3.20.RELEASE-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.20.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b9b54dc5-a53c-5ae7-af90-bad4589f522d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging. CVE-2018-1270 is NOT present in this target. The vulnerability involves SpEL injection through StandardEvaluationContext in Spring Framework's STOMP WebSocket implementation, allowing remote code execution. The target version (4.3.20.RELEASE) already contains the upstream fix that replaced StandardEvaluationContext with SimpleEvaluationContext. This fix was introduced in upstream Spring Framework 4.3.16.RELEASE (per CVE advisory: \"versions 4.3 prior to 4.3.16\" are affected) and was already present when TuxCare onboarded version 4.3.20.RELEASE. The vulnerable code pattern is completely absent from the target.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c65f344e-b240-5d04-9425-441645668b0b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging. The target Spring Framework 4.3.20.RELEASE already contains the upstream security fix for CVE-2018-1275. The vulnerability involved using StandardEvaluationContext for SpEL expression evaluation in STOMP subscription selectors, which allowed attackers to execute arbitrary code via Java reflection. The fix (commit 0009806) replaced StandardEvaluationContext with SimpleEvaluationContext, which restricts reflection-based operations. This fix was authored by upstream Spring Framework developer Rossen Stoyanchev and shipped in v4.3.16.RELEASE and all subsequent versions including v4.3.20.RELEASE. The vulnerable code pattern is not present in the target.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:93b25443-7fb6-512c-b7b2-d9f4862d8532",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:534860e9-9d0e-5f71-b4d6-d55baf9ee432",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 4.3.20.RELEASE-tuxcare.2 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.3.20.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE-tuxcare.2"
    }
  ]
}