{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c5350160-e09d-5ab6-a20c-58332b9e329b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.1.14-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.1.14-tuxcare.2",
      "version": "6.1.14-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.1.14",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.14"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:58c63dfd-69a5-5e31-bf42-97ee47a1e37a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-messaging. CVE-2018-1270 is NOT present in Spring Framework 6.1.14-tuxcare.3. The vulnerability (SpEL injection via STOMP selector headers leading to RCE through StandardEvaluationContext) was fixed by upstream Spring in versions 4.3.16/5.0.5 (March-April 2018). The fix replaced StandardEvaluationContext with SimpleEvaluationContext, eliminating code execution primitives. Target version 6.1.14 inherited this fix from upstream evolution. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:91b1d7a9-00d2-5a39-b407-98cf85610177",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-messaging. CVE-2018-1275 is NOT present in Spring Framework 6.1.14. The vulnerability affected versions prior to 5.0.5 and 4.3.16 due to use of StandardEvaluationContext for SpEL expression evaluation in STOMP subscriptions, which allowed remote code execution. The target version 6.1.14 contains the upstream fix (commit e0de9126ed8cf25cf141d3e66420da94e350708a from March 2018) that replaced StandardEvaluationContext with SimpleEvaluationContext, eliminating the attack vector. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0d382574-9bde-55e8-b452-ccd5522b46b7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.1.14-tuxcare.2 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 affects Spring Framework versions prior to 5.3.20+, 5.2.22+, allowing authenticated users to cause DoS via duplicate STOMP CONNECT frames. The vulnerability was fixed upstream in commit dc2947c52d (May 2022) which added session existence checks before processing CONNECT frames. This fix first appeared in Spring Framework v5.3.20 and is present in all subsequent releases. The targ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.14-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3eb8ac33-3a18-57c5-9130-74083c88f50d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.14-tuxcare.2 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.1.14-tuxcare.2"
    }
  ]
}