{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:962cd8b2-2a72-56cd-bbba-f410469c09f7",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.0.11-tuxcare.7",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.0.11-tuxcare.7",
      "version": "6.0.11-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.0.11",
            "type": "library",
            "group": "org.springframework",
            "version": "6.0.11"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.11-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:b270b785-255c-5436-8ae1-242d66d0e981",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.0.11-tuxcare.7 of org.springframework:spring-messaging. CVE-2018-1270 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16. The target version 6.0.11 is not affected because the vulnerability was fixed by upstream in April 2018 (commit 0009806deb) and shipped in subsequent releases. The target version 6.0.11, released in 2023, already contains the fix: SimpleEvaluationContext is used instead of StandardEvaluationContext for SpEL expression evaluation in STOMP message subscriptions, preventing remote code execution via crafted selector expressions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.11-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:7bae7fc2-9b4b-5900-88de-94b602f68089",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.0.11-tuxcare.7 of org.springframework:spring-messaging. Spring Framework 6.0.11 is not affected by CVE-2018-1275. The vulnerability affects versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16, where STOMP message selector expressions were evaluated using StandardEvaluationContext, allowing remote code execution. Version 6.0.11 already contains the upstream vendor fix (commit e0de9126ed by Rossen Stoyanchev from Pivotal) that replaces StandardEvaluationContext with the restricted SimpleEvaluationContext, preventing exploitation. This fix was present in the upstream release before TuxCare onboarded version 6.0.11.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.11-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:2475aef2-7efb-5811-aebb-eccf4dd3e55b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.0.11-tuxcare.7 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 does not affect Spring Framework 6.0.11. The vulnerability was fixed upstream in April 2022 (commits dc2947c52d and 159a99bbaf) before Spring Framework 6.0.0 was released in November 2022. The fix was already present when TuxCare onboarded version 6.0.11 in July 2023. Both vulnerable files (SimpleBrokerMessageHandler.java and StompBrokerRelayMessageHandler.java) contain the defen...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.11-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:77481504-1919-52fe-86c8-9726e5bbd5c4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.11-tuxcare.7 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.0.11-tuxcare.7"
    }
  ]
}