{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7890e674-cbc5-58ed-b95e-f32c29f088f5",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10",
      "version": "6.0.16-tuxcare.10",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.0.16",
            "type": "library",
            "group": "org.springframework",
            "version": "6.0.16"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:d3cfe3de-3db1-5ec2-8ac1-b8b47655a609",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-messaging. CVE-2018-1270 (STOMP over WebSocket RCE via SpEL injection) is NOT present in spring-framework 6.0.16-tuxcare.12. The vulnerability required StandardEvaluationContext, which allows unrestricted SpEL operations including method invocation and type references. The target uses SimpleEvaluationContext (lines 38, 73-74 of DefaultSubscriptionRegistry.java), which restricts evaluation to safe property access only and prevents code execution. The fix was authored by the upstream vendor (Rossen Stoyanchev, rstoyanchev@pivotal.io) in commit e0de9126ed (March 2018) and was already present in the upstream release before TuxCare's first commit (eb72a44f81ce, askorik@cloudlinux.com). No StandardEvaluationContext usage exists anywhere in the spring-messaging module.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:95ecbdda-d5af-552d-bdc8-05254b2f5a6f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-messaging. The target Spring Framework 6.0.16-tuxcare.12 is NOT affected by CVE-2018-1275. The vulnerability was fixed in upstream Spring Framework 5.0.5 (April 2018) by replacing StandardEvaluationContext with SimpleEvaluationContext to prevent SpEL injection attacks. The fix was already present in the upstream 6.0.16 release when TuxCare onboarded it. The target code uses SimpleEvaluationContext with restricted property access, eliminating the RCE attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:dcde58eb-09ff-5570-b360-614263ea298d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 affects Spring Framework's STOMP over WebSocket endpoint, allowing authenticated users to cause DoS by sending duplicate CONNECT frames for already-connected sessions. The target version 6.0.16 already contains the upstream fix (commit dc2947c52d from 2022-04-29) that adds session-existence checks before processing CONNECT frames. This fix was shipped in the upstream Spring Frame...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:fd0e6ef6-ae1a-50ac-8691-05367384c38e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.0.16-tuxcare.10"
    }
  ]
}