{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3efcc3b3-6c21-56c5-bf52-1d67f581428f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.15-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.15-tuxcare.1",
      "version": "5.3.15-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.15",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.15"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:993ea0ba-5fef-5892-aec2-c11853e7a9f6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.3.15-tuxcare.1 of org.springframework:spring-messaging. CVE-2018-1270 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16, allowing remote code execution via malicious STOMP message selector expressions evaluated with StandardEvaluationContext. The target version 5.3.15 is NOT AFFECTED because the vulnerability was fixed in the upstream release. The vulnerable code pattern (StandardEvaluationContext with unrestricted SpEL access) is not present; the current code uses SimpleEvaluationContext which restricts property access and blocks arbitrary class/method invocation. The fix (commit e0de9126ed) was authored by upstream Spring maintainer Rossen Stoyanchev in March 2018 and was already in the Spring 5.3.15 release when TuxCare onboarded it. No StandardEvaluationContext usage exists in the STOMP messaging code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e89bec20-4c1a-525c-a721-0cd8f59d7b63",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.3.15-tuxcare.1 of org.springframework:spring-messaging. Spring Framework 5.3.15 is not affected by CVE-2018-1275. The vulnerability (remote code execution via STOMP message SpEL selectors using StandardEvaluationContext) was fixed in upstream Spring 5.0.5 (March 2018). Version 5.3.15 (released February 2022) already contains the fix: it uses SimpleEvaluationContext instead of StandardEvaluationContext, restricting SpEL evaluation to safe property access only. The fix was authored by upstream Spring developer Rossen Stoyanchev and shipped with the upstream 5.3.15 release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3c7ac732-ea6c-5465-8e22-3ec3b9dbe098",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.3.15-tuxcare.1 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.15-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6512810b-2ae9-5fc3-8fa5-e817f50bdaa4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.15-tuxcare.1 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.15-tuxcare.1"
    }
  ]
}