{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6b6dbb98-be1d-584e-9f95-1fbbdfef5f70",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.0.19.RELEASE-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.0.19.RELEASE-tuxcare.2",
      "version": "5.0.19.RELEASE-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.0.19.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.0.19.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.0.19.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:44f1c7c4-a80f-5bc2-b8ca-4e1abd5d9176",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-messaging. CVE-2018-1270 is NOT present in Spring Framework 5.0.19.RELEASE. The vulnerability involved using StandardEvaluationContext for SpEL expression evaluation in STOMP message selectors, allowing remote code execution. The upstream vendor (Pivotal) fixed this in commit e0de9126 by replacing StandardEvaluationContext with SimpleEvaluationContext, restricting evaluation to property access only. This fix was already present in the upstream 5.0.19.RELEASE that TuxCare onboarded, making this version not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.0.19.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a202e60f-bb96-5728-b7eb-81afed410a5b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework 5.0 prior to 5.0.5. The target repository is version 5.0.19.RELEASE, which already contains the upstream fix (commit e0de9126ed) that shipped in v5.0.5.RELEASE (March 2018). The vulnerable pattern (StandardEvaluationContext with user-controlled SpEL expressions) is not present in the target code; the fix replaced it with SimpleEvaluationContext, which restricts evaluation to safe property access only and prevents the SpEL injection attack that leads to RCE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.0.19.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:32a89052-3efb-56b6-91e6-d7eb97bb9a42",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.0.19.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:03e1ca49-25d8-53cd-a7fc-a755b00a23ad",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 5.0.19.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.0.19.RELEASE-tuxcare.2"
    }
  ]
}