{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d50400ac-f185-521b-80af-9687b80bf936",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.24-tuxcare.9",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.24-tuxcare.9",
      "version": "5.3.24-tuxcare.9",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.24",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.24"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.24-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:c822a67a-4f5b-58d9-b9af-71055d573e63",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.3.24-tuxcare.9 of org.springframework:spring-messaging. CVE-2018-1270 is not present in Spring Framework 5.3.24. The vulnerability involved using StandardEvaluationContext with the message as root object, allowing arbitrary Java code execution via malicious SpEL expressions in STOMP message selector headers. The upstream fix (commit e0de9126ed8cf25cf141d3e66420da94e350708a, March 2018) replaced StandardEvaluationContext with SimpleEvaluationContext and passes the message as a parameter rather than root object. This fix was included in Spring Framework 5.0.5/4.3.16 and is present in version 5.3.24. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.24-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:e6a6885d-a210-5abc-9eb9-38b4f42d9b3a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.3.24-tuxcare.9 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16 due to unsafe SpEL expression evaluation in STOMP WebSocket subscriptions. The target (Spring Framework 5.3.24-tuxcare.10) already contains the upstream vendor fix from commit e0de9126ed (March 2018, authored by rstoyanchev@pivotal.io). The fix replaces StandardEvaluationContext with SimpleEvaluationContext to prevent SpEL injection attacks. This fix was included in the upstream 5.3.24 release that TuxCare onboarded, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.24-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:4483887e-7337-5938-bc2d-ba108d4e5403",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 5.3.24-tuxcare.9 of org.springframework:spring-messaging. not_affected \u2014 The target Spring Framework 5.3.24 is not affected by CVE-2022-22971. The vulnerability (DoS via duplicate STOMP CONNECT frames on already-connected sessions) was fixed in upstream commit dc2947c52df18d5e99cad03383f7d6ba13d031fd by Rossen Stoyanchev (VMware) on 2022-04-29, which shipped in upstream v5.3.20 (released 2022-05-11). The target version 5.3.24 (released 2022-11-16) already contained ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.24-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:e66acc55-24fe-55e5-b285-5cd51d01fd1f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.24-tuxcare.9 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.24-tuxcare.9"
    }
  ]
}