{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d759ee35-84fa-524e-8bbe-e7e128187ba5",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.3-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.3-tuxcare.2",
      "version": "5.3.3-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.3",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0ede5c74-13dc-5aa4-aa93-b5c66f8a24ff",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-messaging. CVE-2018-1270 is not present in Spring Framework 5.3.3. The vulnerable code pattern (using StandardEvaluationContext with STOMP message as root object, allowing arbitrary Java method invocation via SpEL expressions) was replaced with SimpleEvaluationContext (which restricts evaluation to safe property access only) in upstream commit e0de9126ed dated March 21, 2018. This fix was included in Spring Framework 5.0.5, 4.3.16, and all subsequent releases including 5.3.0+. The target version 5.3.3 inherited this fix from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:938fe989-1513-568a-984e-9fbffb7a7b00",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.3.3-tuxcare.2 of org.springframework:spring-messaging. The target Spring Framework 5.3.3 is not affected by CVE-2018-1275. The vulnerability fix (replacing StandardEvaluationContext with SimpleEvaluationContext to prevent RCE via malicious STOMP selector expressions) was already present in the upstream 5.3.3 release that TuxCare onboarded. The fix commit e0de9126ed by rstoyanchev@pivotal.io is an ancestor of both the TuxCare onboarding commit and HEAD. Code inspection confirms the secure implementation is present in DefaultSubscriptionRegistry.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:79c06f9d-519a-520d-8904-919901078a6a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22971 affects version 5.3.3-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d64f4227-68a8-5963-9801-472c6a0751d6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.3-tuxcare.2 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.3-tuxcare.2"
    }
  ]
}