{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:465f068d-906a-5248-9d1f-066481e480c9",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.2.7.RELEASE-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.2.7.RELEASE-tuxcare.3",
      "version": "5.2.7.RELEASE-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.2.7.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.2.7.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.7.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:d0f5beb4-a4bb-51e0-b977-5a5d67d1abb4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.2.7.RELEASE-tuxcare.3 of org.springframework:spring-messaging. CVE-2018-1270 affects Spring Framework versions with STOMP over WebSocket using StandardEvaluationContext, allowing remote code execution via malicious SpEL selector expressions. The target (Spring Framework 5.2.7.RELEASE-tuxcare.3) is NOT AFFECTED because the upstream vendor (Spring/Pivotal) fixed this vulnerability in commit e0de9126ed (March 21, 2018), replacing StandardEvaluationContext with SimpleEvaluationContext. This fix was already present in the upstream 5.2.7.RELEASE (June 9, 2020) that TuxCare onboarded. The vulnerable pattern (StandardEvaluationContext with message as root object allowing arbitrary method invocation) does not exist in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.7.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:bb5dca13-cfce-5d3f-aeb9-6dab356a1428",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.2.7.RELEASE-tuxcare.3 of org.springframework:spring-messaging. CVE-2018-1275 vulnerability is NOT present in Spring Framework 5.2.7.RELEASE. The vulnerable pattern (use of StandardEvaluationContext for evaluating untrusted SpEL expressions from STOMP message selectors, enabling remote code execution) was fixed by the upstream Spring Framework team in March 2018 (commit e0de9126ed) - two years before the 5.2.7.RELEASE was published in June 2020. The target uses SimpleEvaluationContext, which restricts SpEL evaluation to property access only and prevents arbitrary code execution. This fix was already in the upstream release when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.7.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:257e03f4-5387-562c-a0d8-f22e3136e2e4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22971 affects version 5.2.7.RELEASE-tuxcare.3 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.7.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:e00f7f19-6a28-5d77-91af-468bb6571f96",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.7.RELEASE-tuxcare.3 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.2.7.RELEASE-tuxcare.3"
    }
  ]
}