{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:92876f16-0da3-512f-b90d-5239838668ee",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.1.5.RELEASE-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.1.5.RELEASE-tuxcare.6",
      "version": "5.1.5.RELEASE-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.1.5.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.1.5.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.5.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:543e36a7-a3f7-58e0-88a9-1ca961441244",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-messaging. CVE-2018-1270 is not present in Spring Framework 5.1.5.RELEASE. The vulnerability involved using StandardEvaluationContext for SpEL expression evaluation in STOMP message selectors, allowing arbitrary method invocation. The upstream vendor (Pivotal/VMware) fixed this in commit e0de9126ed by replacing StandardEvaluationContext with SimpleEvaluationContext, which restricts evaluation to property access only. This fix was already present in the upstream 5.1.5.RELEASE that TuxCare onboarded, as confirmed by the fix being an ancestor of TuxCare's first commit (302ea3312a). The target code shows SimpleEvaluationContext usage throughout.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.5.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:835cc0b4-71c7-5e59-a178-d57341708140",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-messaging. CVE-2018-1275 is NOT present in Spring Framework 5.1.5.RELEASE. The vulnerability exploited StandardEvaluationContext in STOMP message selector evaluation to achieve RCE via SpEL injection. The fix (replacing StandardEvaluationContext with SimpleEvaluationContext) was applied by upstream vendor Pivotal in March 2018 (commit e0de9126ed) and shipped in the upstream 5.1.5.RELEASE before TuxCare onboarding. The target code uses SimpleEvaluationContext with restricted property accessors, blocking Java reflection access. No StandardEvaluationContext exists in the spring-messaging module.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.5.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:30454397-7b64-59f4-97d4-b532e172dcdc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.5.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:30c16864-85a4-528c-9401-7e2a622c09bc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 5.1.5.RELEASE-tuxcare.6 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 5.1.5.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.1.5.RELEASE-tuxcare.6"
    }
  ]
}