{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:34a9a93f-de58-5e8c-84ad-051050d8e1da",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.0.15-tuxcare.7",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.0.15-tuxcare.7",
      "version": "6.0.15-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.0.15",
            "type": "library",
            "group": "org.springframework",
            "version": "6.0.15"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.15-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:1b0db47c-3f0b-540d-802c-3df95032b4e0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.0.15-tuxcare.7 of org.springframework:spring-messaging. CVE-2018-1270 is NOT present in Spring Framework 6.0.15-tuxcare.6. The vulnerability (SpEL injection via StandardEvaluationContext in STOMP message selectors) was fixed by upstream commit e0de9126ed (2018-03-21) by Rossen Stoyanchev, which replaced StandardEvaluationContext with SimpleEvaluationContext. This fix was already present in Spring Framework 6.0.15 when TuxCare onboarded it (2026-08-21), making the target safe from this vulnerability. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.15-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:76a0766a-f9ff-5ca5-a32f-0721c84564fb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.0.15-tuxcare.7 of org.springframework:spring-messaging. CVE-2018-1275 addresses a SpEL injection vulnerability in Spring Framework's STOMP WebSocket message broker that allowed remote code execution. The vulnerability existed when DefaultSubscriptionRegistry used StandardEvaluationContext to evaluate SpEL expressions from selector headers, enabling attackers to craft malicious expressions with arbitrary code execution. The target repository (Spring Framework 6.0.15) is NOT AFFECTED because the upstream fix by Rossen Stoyanchev (commit e0de9126, March 21, 2018) was already included in the upstream 6.0.15 release that TuxCare onboarded. The fix replaced StandardEvaluationContext with SimpleEvaluationContext, which restricts SpEL to property access only and blocks Java type references, constructors, and bean references. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.15-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:808b820d-7a39-5f07-ad9f-731f16243f23",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.0.15-tuxcare.7 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 affects Spring Framework versions prior to 5.3.20+ and 5.2.22+. The target version 6.0.15 already contains the upstream fix (commit dc2947c52d) which was first released in Spring Framework 5.3.20. The fix adds validation to reject duplicate STOMP CONNECT frames for already-connected sessions, preventing denial-of-service attacks via resource exhaustion. Both SimpleBrokerMessageHa...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.15-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:32be3e27-afde-566c-8e22-964759a85a0d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.15-tuxcare.7 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.0.15-tuxcare.7"
    }
  ]
}