{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ac4895eb-e032-56a3-b703-dd33ec46d672",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11",
      "version": "5.3.29-tuxcare.11",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.29",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.29"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:02901d14-69eb-5412-b53e-b485a1563bbe",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-messaging. CVE-2018-1270 is NOT present in Spring Framework 5.3.29. The vulnerability involved using StandardEvaluationContext for evaluating STOMP selector expressions, which allowed SpEL injection attacks enabling arbitrary code execution. The upstream fix (commit e0de9126ed8) replaced StandardEvaluationContext with SimpleEvaluationContext and changed from passing the message as root object to passing it as a parameter. This fix was already present in the upstream Spring Framework 5.3.29 release before TuxCare began maintaining this version, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:a1bf98b5-c1fe-50ca-bb66-260164286f75",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16. The target version 5.3.29 contains the upstream fix (commit e0de9126ed) that replaced StandardEvaluationContext with SimpleEvaluationContext in DefaultSubscriptionRegistry.java, restricting SpEL evaluation to property access only and preventing remote code execution via malicious STOMP selector expressions. The fix was shipped in the upstream release before TuxCare onboarded version 5.3.29.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:9ed28a7e-f287-5845-9dba-990527115e46",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 is NOT present in spring-framework 5.3.29-tuxcare.12. The vulnerability (DoS via duplicate STOMP CONNECT frames causing resource exhaustion) was fixed by upstream Spring Framework commit dc2947c52df18d5e99cad03383f7d6ba13d031fd (author: rstoyanchev@vmware.com), which shipped in Spring Framework 5.3.20. Since the target version is 5.3.29, the fix was already present in the upstrea...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:eeaf5eaf-d973-5c24-9442-2c54967b29d1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.29-tuxcare.11"
    }
  ]
}