{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6120cbbe-26ca-57b3-9fe2-bccd86e6b7e2",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6",
      "version": "6.1.15-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.1.15",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.15"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:85e455f2-72b3-54b7-80e2-21a3fbb3eca4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-messaging. The target Spring Framework 6.1.15 is not affected by CVE-2018-1270. The vulnerability was fixed by upstream Spring Framework in commit e0de9126ed (March 2018), which replaced StandardEvaluationContext with SimpleEvaluationContext to restrict SpEL expression evaluation to property access only. This fix was already present in the upstream release that TuxCare onboarded in July 2026, making the vulnerable pattern (unrestricted SpEL evaluation via StandardEvaluationContext) absent from the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:264b34c9-04b6-56bb-bf69-a808f3729eab",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-messaging. Spring Framework 6.1.15-tuxcare.6 is NOT affected by CVE-2018-1275. The vulnerability (RCE via StandardEvaluationContext in STOMP message selector evaluation) was fixed in upstream Spring Framework and the fix was already present in the 6.1.15 release that TuxCare onboarded. The code uses SimpleEvaluationContext with restricted property access instead of the vulnerable StandardEvaluationContext, completely blocking the arbitrary code execution attack vector. Fix commit e0de9126ed authored by rstoyanchev@pivotal.io (upstream Spring developer) was included in the upstream release before TuxCare's onboarding commit dad287df413dc19e3cf8b6705f4eb4514d784162.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:611f8c8f-e813-56af-83d1-e60ed31d3029",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 6.1.15 is not affected by CVE-2022-22971. The vulnerability affects applications with STOMP over WebSocket endpoints that fail to validate duplicate CONNECT frames, allowing authenticated users to exhaust server resources. The fix (commit dc2947c52df by rstoyanchev@vmware.com from April 2022) was already present in the upstream Spring Framework 6.1.15 release before TuxCare onb...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:689e98dc-fbfc-5e77-a64d-417527290e2e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.1.15-tuxcare.6"
    }
  ]
}