{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c921c172-cd9c-5b3d-8d7a-e020040420a7",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.1.6.RELEASE-tuxcare.5",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.1.6.RELEASE-tuxcare.5",
      "version": "5.1.6.RELEASE-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.1.6.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.1.6.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.6.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:c93b0fa6-f9dd-5b00-98db-824c56af8ce7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.1.6.RELEASE-tuxcare.5 of org.springframework:spring-messaging. CVE-2018-1270 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16. The vulnerability involves using StandardEvaluationContext for SpEL expression evaluation in STOMP message filtering, allowing remote code execution via crafted selector headers. The target version 5.1.6.RELEASE already contains the upstream fix (commit e0de9126) that replaced StandardEvaluationContext with SimpleEvaluationContext, which was first released in v5.0.5.RELEASE. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.6.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:8e37fa54-571a-53f0-9dba-288feb0a1118",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.1.6.RELEASE-tuxcare.5 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16. The target is version 5.1.6.RELEASE, which already includes the upstream fix (commit e0de9126) that replaced StandardEvaluationContext with SimpleEvaluationContext in DefaultSubscriptionRegistry. The fix was first released in Spring Framework 5.0.5.RELEASE (March 2018) and was already present when TuxCare onboarded version 5.1.6.RELEASE. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.6.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:af68aa5f-9b58-5054-b752-b3c9a514e770",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.6.RELEASE-tuxcare.5 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.6.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:0eb17095-ea01-572d-9e21-2e9e933654a1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 5.1.6.RELEASE-tuxcare.5 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 5.1.6.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.1.6.RELEASE-tuxcare.5"
    }
  ]
}