{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:31288657-a6ff-50ec-b47c-8bdfe088aa67",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11",
      "version": "6.0.23-tuxcare.11",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.0.23",
            "type": "library",
            "group": "org.springframework",
            "version": "6.0.23"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:588d28d1-6a7f-5d86-8398-893d2d170ab1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-messaging. CVE-2018-1270 is not present in Spring Framework 6.0.23-tuxcare.12. The vulnerability was fixed in upstream Spring Framework before the 6.0.23 release. The vulnerable pattern (use of StandardEvaluationContext for evaluating STOMP selector expressions) has been replaced with SimpleEvaluationContext, which restricts SpEL evaluation to registered property accessors only and prevents arbitrary code execution. Fix commit e0de9126ed8cf25cf141d3e66420da94e350708a by Rossen Stoyanchev was included in the upstream release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:0dd08c96-6ab0-5a8b-bc40-b02cd94fc446",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16 through unsafe SpEL evaluation using StandardEvaluationContext. The target version 6.0.23 is not affected - the upstream fix (commit e0de9126) replacing StandardEvaluationContext with SimpleEvaluationContext was already present in the 6.0.x release line before TuxCare onboarding. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:4eb05c21-db80-5a38-974d-2d51f428688f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 affects Spring Framework versions prior to 5.3.20+ and 5.2.22+ due to a vulnerability where authenticated users could send duplicate STOMP CONNECT frames to cause denial of service. The target (Spring Framework 6.0.23-tuxcare.12) is not affected because the upstream fix was already present in the release before TuxCare onboarding. The fix (commit dc2947c52d by rstoyanchev@vmware....",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:e914d098-cff2-5406-840c-e7b9a98df9e4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.0.23-tuxcare.11"
    }
  ]
}