{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7719719e-9f4e-54e8-9aa8-95b7c96191a0",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.33-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.33-tuxcare.4",
      "version": "5.3.33-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.33",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.33"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.33-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:c98f6131-d011-5539-bc7f-16e87f6d232d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.3.33-tuxcare.4 of org.springframework:spring-messaging. The target Spring Framework 5.3.33 is not affected by CVE-2018-1270 (SpEL injection via STOMP selector expressions). The vulnerability required StandardEvaluationContext with unrestricted SpEL evaluation, but the target uses SimpleEvaluationContext with restricted property access only. The fix was authored by upstream Spring Framework (Rossen Stoyanchev from Pivotal) in March 2018 and was already present in the upstream release 5.3.33 when TuxCare onboarded it in commit 0436f56340.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.33-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:b9e70cb8-86fd-509f-b622-999437c5ae11",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.3.33-tuxcare.4 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework versions with STOMP over WebSocket that use StandardEvaluationContext for SpEL expression evaluation in message selectors, allowing remote code execution. The target (Spring Framework 5.3.33) is NOT AFFECTED because the vulnerable code pattern has been removed by an upstream fix (commit e0de9126ed by Rossen Stoyanchev) that was already present in the upstream 5.3.33 release. The fix replaces StandardEvaluationContext with SimpleEvaluationContext, which restricts SpEL evaluation to property access only and prevents arbitrary code execution. The target code uses SimpleEvaluationContext throughout and passes messages as parameters rather than as root objects, fully implementing the security fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.33-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:3b8ff049-8bad-5e58-979e-472e6d90df37",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 5.3.33-tuxcare.4 of org.springframework:spring-messaging. not_affected \u2014 Target version 5.3.33 is NOT AFFECTED by CVE-2022-22971. The vulnerability fix (duplicate CONNECT frame validation) was already present in the upstream Spring Framework 5.3.20 release, which predates version 5.3.33. Both SimpleBrokerMessageHandler and StompBrokerRelayMessageHandler contain the necessary session-existence checks that prevent the denial-of-service attack via repeated CONNECT fram...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.33-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:4046e6ff-fd0b-5294-a1fa-d724796714a7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.33-tuxcare.4 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.33-tuxcare.4"
    }
  ]
}