{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:38354117-9d8b-56d9-b19b-272f1ec8f491",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.5-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.5-tuxcare.1",
      "version": "5.3.5-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.5",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6dfd34bd-0ae0-543a-9854-077dd3202486",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.3.5-tuxcare.1 of org.springframework:spring-messaging. CVE-2018-1270 is a SpEL injection vulnerability in Spring Framework's STOMP over WebSocket support. Applications using the in-memory STOMP broker allow attackers to execute arbitrary code by crafting malicious SpEL expressions in subscription selectors. The vulnerability requires StandardEvaluationContext, which enables constructor calls and method invocations. The target (Spring Framework 5.3.5-tuxcare.2) is NOT AFFECTED because the fix was already present in the upstream 5.3.5 release. The vulnerable StandardEvaluationContext was replaced with SimpleEvaluationContext in commit e0de9126ed (March 2018) by upstream Spring developer Rossen Stoyanchev, restricting SpEL evaluation to property access only and eliminating the code execution attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c35e44e9-871c-58c1-bd1b-d21880367f29",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.3.5-tuxcare.1 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16, where STOMP subscription selector expressions are evaluated using StandardEvaluationContext, allowing remote code execution via crafted SpEL expressions. The target version 5.3.5 is NOT affected because the upstream fix (commit e0de9126ed by Rossen Stoyanchev, March 2018) was already present in the Spring Framework 5.3.5 release. The code uses SimpleEvaluationContext instead of StandardEvaluationContext, restricting expression evaluation to property access only and preventing method invocation or class instantiation. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9d0182d8-dbe1-5609-9849-1aaa491d5ad0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22971 affects version 5.3.5-tuxcare.1 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:06462a6f-f7a6-5f85-94a5-e6d88777a92e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.5-tuxcare.1 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.5-tuxcare.1"
    }
  ]
}