{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7f4b9458-2e08-5b66-89c8-ad7909536503",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.6",
      "version": "5.1.20.RELEASE-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.1.20.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:856e1e88-2752-59c5-a5d0-588bb1c28e22",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-messaging. The target Spring Framework version 5.1.20.RELEASE is NOT affected by CVE-2018-1270. The vulnerability (remote code execution via unsafe SpEL expression evaluation using StandardEvaluationContext in STOMP message selectors) was fixed by the upstream Spring team in commit e0de9126ed (March 2018), which replaced StandardEvaluationContext with SimpleEvaluationContext. This fix was already present in the upstream 5.1.20.RELEASE version that TuxCare onboarded, as confirmed by examining the code at the initial TuxCare setup commit (cad3646bcd). The vulnerable pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:f58b8bd1-c86a-53c1-b1f3-5c2c271cfb55",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-messaging. CVE-2018-1275 is NOT present in Spring Framework 5.1.20.RELEASE. The vulnerability affected versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16. The target version 5.1.20.RELEASE (released December 2020) already contains the upstream fix from commit e0de9126ed (March 2018) authored by Rossen Stoyanchev at Pivotal. The fix replaced StandardEvaluationContext with SimpleEvaluationContext in DefaultSubscriptionRegistry, preventing arbitrary code execution via malicious SpEL expressions in STOMP subscription selectors. TuxCare onboarded an already-fixed upstream version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:46d47240-74d0-59c7-9e3d-2bec07e4dc5f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:e93a6a2d-7f28-5ad5-b4a5-0901754a6d8d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 5.1.20.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.1.20.RELEASE-tuxcare.6"
    }
  ]
}