{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f065f5f1-8c53-5dd4-a4d2-f1faf44ebef8",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.1.9.RELEASE-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.1.9.RELEASE-tuxcare.6",
      "version": "5.1.9.RELEASE-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.1.9.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.1.9.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.9.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:256a9600-48e2-5f52-8a59-6504d3b90e43",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-messaging. CVE-2018-1270 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16 through SpEL injection in STOMP message selectors. The target version 5.1.9.RELEASE already contains the upstream fix (commit e0de9126ed) that replaced StandardEvaluationContext with SimpleEvaluationContext, eliminating the ability to execute arbitrary code through SpEL expressions. The fix was shipped in upstream Spring Framework 5.0.5.RELEASE, well before this version. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.9.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:938ec836-14d0-529a-8713-65761b8dec23",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16, allowing RCE via malicious SpEL expressions in STOMP subscription selector headers. The target version 5.1.9.RELEASE already contains the upstream fix (commit e0de9126 by Rossen Stoyanchev, March 2018) that replaces StandardEvaluationContext with SimpleEvaluationContext, preventing arbitrary code execution. The vulnerable code pattern is not present in the target\u2014the fix was included in the upstream release when TuxCare onboarded version 5.1.9.RELEASE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.9.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:d6ab7859-5f3e-52a1-bb7c-dfecc929c52d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.9.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:f91976a1-25c1-5f12-8994-50d0cba83b81",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 5.1.9.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.1.9.RELEASE-tuxcare.6"
    }
  ]
}