{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4cef8d97-1a7e-5627-ace8-a8a8d448ba5b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.1.19.RELEASE-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.1.19.RELEASE-tuxcare.3",
      "version": "5.1.19.RELEASE-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.1.19.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.1.19.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.19.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:e9ee4079-58bf-5a6d-ae1a-829bdeca83c0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.1.19.RELEASE-tuxcare.3 of org.springframework:spring-messaging. CVE-2018-1270 is not present in Spring Framework 5.1.19.RELEASE. The vulnerability affected versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16. The target version 5.1.19.RELEASE already contains the upstream security fix (commit e0de9126ed) that replaced StandardEvaluationContext with SimpleEvaluationContext, preventing arbitrary code execution through SpEL expressions in STOMP subscription selectors. This fix was shipped in the upstream release that TuxCare onboarded, not backported separately by TuxCare.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.19.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:676fd013-f1a4-517c-bb2b-70502eab3281",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.1.19.RELEASE-tuxcare.3 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16, where STOMP over WebSocket endpoints use StandardEvaluationContext for SpEL expression evaluation, allowing RCE. The target version 5.1.19.RELEASE already contains the upstream fix (commit e0de9126ed by rstoyanchev@pivotal.io from March 2018) that replaces StandardEvaluationContext with SimpleEvaluationContext. The vulnerable code pattern is not present in the target because the fix was already shipped in the upstream 5.1.19.RELEASE that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.19.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:0616640b-67a2-505a-8cbd-bbc2c46fa5e1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.19.RELEASE-tuxcare.3 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.19.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:20c40af6-2d65-5a12-bf56-8268bce7f705",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 5.1.19.RELEASE-tuxcare.3 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 5.1.19.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.1.19.RELEASE-tuxcare.3"
    }
  ]
}