{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:318d0b64-d3cb-5568-8be5-81aa9bedf9d7",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.1.3.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.1.3.RELEASE-tuxcare.1",
      "version": "5.1.3.RELEASE-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.1.3.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.1.3.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.3.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dd611fb5-5a3a-5171-b608-bbdde082f92a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.1.3.RELEASE-tuxcare.1 of org.springframework:spring-messaging. CVE-2018-1270: Spring Framework STOMP over WebSocket SpEL injection vulnerability. The target version 5.1.3.RELEASE is NOT affected because the upstream fix (replacing StandardEvaluationContext with SimpleEvaluationContext) was already present in the upstream release before TuxCare onboarded it. The vulnerable code pattern does not exist in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.3.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7b587ab1-eae5-5b86-95f3-bd33c031eea7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.1.3.RELEASE-tuxcare.1 of org.springframework:spring-messaging. CVE-2018-1275: Spring Framework 5.1.3.RELEASE is NOT AFFECTED. The vulnerability (SpEL injection via STOMP selector headers using StandardEvaluationContext) was fixed in upstream Spring Framework 5.0.5.RELEASE (March 2018) and is already absent from version 5.1.3.RELEASE. The fix commit e0de9126ed by upstream author rstoyanchev@pivotal.io replaced StandardEvaluationContext with SimpleEvaluationContext, restricting SpEL evaluation to property access only and preventing arbitrary code execution. TuxCare onboarded this version on 2018-12-18 with the fix already present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.3.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:da4e33cc-b210-528a-90a6-a7f24c14e0ad",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.3.RELEASE-tuxcare.1 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.3.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:619cdeae-dc91-5f8b-a3ab-b7c7eace0f0b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 5.1.3.RELEASE-tuxcare.1 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 5.1.3.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.1.3.RELEASE-tuxcare.1"
    }
  ]
}