{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a365cc6a-79d6-53f8-9342-d96d08ef8fca",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.13",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.13",
      "version": "5.3.37-tuxcare.13",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.37",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.37"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:af2288d0-5024-5680-8557-5f781dfc604d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-messaging. CVE-2018-1270 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16 through unsafe use of StandardEvaluationContext for evaluating STOMP selector expressions, enabling SpEL injection and remote code execution. The target version 5.3.37 is NOT AFFECTED because the vulnerable code pattern does not exist - the fix was already present in the upstream Spring Framework 5.3.37 release. The code uses SimpleEvaluationContext (a restricted, safe evaluation context) instead of StandardEvaluationContext (which allows arbitrary method invocation). This fix was authored by Rossen Stoyanchev from Pivotal/VMware and was included in the upstream release before TuxCare onboarded version 5.3.37.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:3b704c10-64b4-5c38-9f16-91d082a940fe",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework versions prior to 5.0.5 and 4.3.16 due to unsafe SpEL expression evaluation in DefaultSubscriptionRegistry. The target version 5.3.37 already contains the upstream fix (commit e0de9126ed) that replaced StandardEvaluationContext with SimpleEvaluationContext, eliminating the ability to execute arbitrary code through crafted STOMP selector expressions. The fix was authored by upstream Spring maintainer Rossen Stoyanchev and shipped in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:0351e073-570e-5f05-93bc-9c8410ef4a01",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 affects Spring Framework versions prior to 5.3.20. The target version 5.3.37-tuxcare.13 already contains the upstream fix (commit dc2947c52d) which was shipped in the original Spring Framework 5.3.37 release. The fix adds validation to reject duplicate STOMP CONNECT frames for already-connected sessions, preventing the DoS attack vector. The vulnerable code pattern is not present...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:417a5ad5-2257-55c3-9abf-43b0ca605cc5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.37-tuxcare.13"
    }
  ]
}