{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0be6a2fc-ef9b-5932-bae0-99971e2469bf",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.2.11.RELEASE-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.2.11.RELEASE-tuxcare.3",
      "version": "5.2.11.RELEASE-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.2.11.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.2.11.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.11.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:239fd83f-7d2d-51a7-ae2f-8ab2d360a1d7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-messaging. Target version 5.2.11.RELEASE is not affected by CVE-2018-1270. The vulnerability (unrestricted SpEL expression evaluation via StandardEvaluationContext) was fixed by upstream Spring Framework in v5.0.5.RELEASE (March 2018). The target code uses SimpleEvaluationContext with controlled property access, preventing arbitrary code execution through selector expressions. This fix was already present in the upstream release that TuxCare onboarded, making the target inherently safe from this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.11.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:7adb215c-0d16-587d-82a2-2ee53e5a7e9a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-messaging. CVE-2018-1275 is NOT present in Spring Framework 5.2.11.RELEASE. The vulnerability involved unrestricted SpEL evaluation using StandardEvaluationContext in STOMP message selector headers, enabling remote code execution. The upstream fix (commit e0de9126 by Rossen Stoyanchev on 2018-03-21) replaced StandardEvaluationContext with SimpleEvaluationContext, which disables dangerous SpEL features like type references, method invocation, and constructor calls. This fix was already included in the upstream 5.2.11.RELEASE when TuxCare onboarded it in September 2026. The target code at HEAD uses SimpleEvaluationContext.forPropertyAccessors() with a restricted property accessor and passes the message as a parameter (not as root object), matching the fixed state from the patches.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.11.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:d2f44f15-c64b-5576-aa8d-03eed3c1495a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22971 affects version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.11.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:64ba2f9c-6670-51aa-a9a1-768a7b867e39",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.11.RELEASE-tuxcare.3 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.2.11.RELEASE-tuxcare.3"
    }
  ]
}