{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d49d4459-a7d5-5b67-94ef-fc79b828612a",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10",
      "version": "5.3.27-tuxcare.10",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.27",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.27"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:9d5abf9f-e320-5554-a6fe-e47e5cca921a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-messaging. CVE-2018-1270 is NOT present in Spring Framework 5.3.27. The vulnerability involved using StandardEvaluationContext for user-controlled SpEL expressions in STOMP subscription selectors, enabling remote code execution via reflection. The fix (commit e0de9126ed) replaced StandardEvaluationContext with SimpleEvaluationContext, which restricts evaluation to configured property accessors and prevents reflection-based attacks. This fix was authored by the upstream Spring team (Rossen Stoyanchev, Pivotal) and shipped in the upstream 5.3.27 release that TuxCare onboarded. The vulnerable code pattern is completely absent from the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:8af49da7-6c47-523b-9366-cbb056ce275b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-messaging. CVE-2018-1275 is a remote code execution vulnerability in Spring Framework's STOMP WebSocket messaging via malicious SpEL expressions in subscription selectors. The CVE affects versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16. The target version 5.3.27 already contains the upstream fix (commit e0de9126ed from 2018-03-21, included in v5.0.5.RELEASE on 2018-04-03). The fix replaces StandardEvaluationContext with SimpleEvaluationContext and eliminates root object access in SpEL evaluation, preventing arbitrary code execution. The vulnerable code pattern is not present in the target because the upstream vendor's fix was already shipped in v5.3.27.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:113fd252-fbca-5d2b-87a9-014a4c88c21d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 5.3.27-tuxcare.10 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 is not present in Spring Framework 5.3.27. The upstream vendor (Spring Framework) fixed this DoS vulnerability in version 5.3.20 by adding checks to prevent duplicate STOMP CONNECT frames on the same session. The fix was already present in the upstream 5.3.27 release that TuxCare started from, authored by rstoyanchev@vmware.com. Both SimpleBrokerMessageHandler and StompBrokerRela...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:56507812-6510-5210-9e6d-b16260ffd67d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.27-tuxcare.10 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.27-tuxcare.10"
    }
  ]
}