{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:e1ffe6fe-0b53-5a63-b7e3-fe27db96b7c4",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.0.0-tuxcare.5",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.0.0-tuxcare.5",
      "version": "6.0.0-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.0.0",
            "type": "library",
            "group": "org.springframework",
            "version": "6.0.0"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.0-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:b05daab2-5224-5b50-855d-4566622e0271",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.0.0-tuxcare.5 of org.springframework:spring-messaging. Spring Framework 6.0.0 is not affected by CVE-2018-1270. The vulnerability involved using StandardEvaluationContext for evaluating SpEL expressions in STOMP message selectors, which allowed remote code execution through crafted expressions. The fix (commit e0de9126) replaced StandardEvaluationContext with SimpleEvaluationContext, restricting expression evaluation to safe property access only. This fix was already present in the upstream Spring Framework 6.0.0 release that TuxCare onboarded (first TuxCare commit f140461cc7). The target code correctly uses SimpleEvaluationContext and passes messages as parameters rather than root objects, preventing arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.0-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:3851100f-d094-5ac3-a249-83bdf983fc7e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.0.0-tuxcare.5 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16, allowing remote code execution via unrestricted SpEL expressions in STOMP message selectors. The target repository (Spring Framework 6.0.0-tuxcare.6) is NOT AFFECTED because it already contains the upstream fix. The vulnerable StandardEvaluationContext was replaced with SimpleEvaluationContext (which restricts SpEL to safe property access only) in the upstream Spring Framework release before version 6.0.0 was created. This fix was introduced by upstream commit cb8c6e3251 (author: rstoyanchev@pivotal.io) and was already present when TuxCare onboarded version 6.0.0.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.0-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:3952ed85-ef3f-5a31-9a07-2eb4f83cb7de",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.0.0-tuxcare.5 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 is not present in Spring Framework 6.0.0-tuxcare.5. The vulnerability, which allowed authenticated users to cause denial of service by sending repeated STOMP CONNECT frames to exhaust server resources, was fixed in the upstream Spring Framework release. The fix (commit dc2947c52d by rstoyanchev@vmware.com) adds validation to reject CONNECT frames for sessions that are already con...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.0-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:10c856f8-83b0-5230-ab52-4fc2f081fb5a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.0-tuxcare.5 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.0.0-tuxcare.5"
    }
  ]
}