{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3c8f73fa-ed4f-5a7a-901c-814c8b64083e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.25-tuxcare.10",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.25-tuxcare.10",
      "version": "5.3.25-tuxcare.10",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.25",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.25"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.25-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:86d95385-9dd9-503e-bef1-9b81d195d2dd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.3.25-tuxcare.10 of org.springframework:spring-messaging. The target (Spring Framework 5.3.25-tuxcare.11) is NOT affected by CVE-2018-1270. The vulnerable code pattern (use of StandardEvaluationContext for evaluating STOMP selector expressions, enabling SpEL injection and remote code execution) is not present in the target. The fix was applied by upstream Spring Framework in commit e0de9126ed8cf25cf141d3e66420da94e350708a (March 2018) and shipped in Spring 5.0.5. Spring 5.3.25 (released January 2023) already contains this upstream fix, using SimpleEvaluationContext instead of StandardEvaluationContext to restrict SpEL evaluation to property access only, preventing arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.25-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:b191c912-c95c-5495-a1f0-070b8b2a382f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.3.25-tuxcare.10 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework's STOMP WebSocket message handling through SpEL injection in subscription selector headers. The vulnerability requires StandardEvaluationContext which allows arbitrary method invocation. The target (spring-framework 5.3.25-tuxcare.11) contains the upstream fix in commit e0de9126ed authored by rstoyanchev@pivotal.io, which replaced StandardEvaluationContext with the restricted SimpleEvaluationContext. This fix was already present in the upstream 5.3.25 release before TuxCare onboarded it. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.25-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:92845f66-b8ab-5b94-9a05-6155ce54bb5e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 5.3.25-tuxcare.10 of org.springframework:spring-messaging. not_affected \u2014 Target version 5.3.25 is NOT affected by CVE-2022-22971. The upstream Spring Framework 5.3.25 release already contained the fix for the STOMP over WebSocket denial of service vulnerability. The defensive checks that prevent duplicate CONNECT frame processing are present in both SimpleBrokerMessageHandler and StompBrokerRelayMessageHandler. The fix was authored by upstream maintainer rstoyanchev...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.25-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:c1cf6bfc-0dae-5178-9f21-b7a4af068aab",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.25-tuxcare.10 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.25-tuxcare.10"
    }
  ]
}