{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4e7d0255-6455-58ed-8e13-cf6a7946b5f3",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.7",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.7",
      "version": "6.1.16-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.1.16",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.16"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:92dacb34-1682-5f11-93d1-dad00534dc28",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.1.16-tuxcare.7 of org.springframework:spring-messaging. CVE-2018-1270 affects Spring Framework versions 5.0 < 5.0.5 and 4.3 < 4.3.16, where STOMP over WebSocket endpoints used StandardEvaluationContext for SpEL expression evaluation, allowing RCE through malicious selector expressions. The target version 6.1.16-tuxcare.7 is not affected because the upstream fix (commit e0de9126ed, March 2018) replaced StandardEvaluationContext with SimpleEvaluationContext, eliminating reflection-based code execution. This fix was already present in Spring Framework 6.1.16 before TuxCare's involvement. Additionally, Spring Framework 6.1+ disables SpEL selector support by default, requiring explicit configuration.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:127389ec-c2a7-53f0-b9fb-889538a0167b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.1.16-tuxcare.7 of org.springframework:spring-messaging. Spring Framework 6.1.16-tuxcare.7 is not affected by CVE-2018-1275. The vulnerability (unrestricted SpEL evaluation via StandardEvaluationContext) was fixed in upstream Spring Framework v5.0.5.RELEASE (March 21, 2018) by commit e0de9126. The fix replaced StandardEvaluationContext with SimpleEvaluationContext in DefaultSubscriptionRegistry, restricting selector header expression evaluation to property access only. Version 6.1.16 (released 2024) inherited this fix from upstream - the vulnerable code pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:70177c11-be88-5a63-b6f6-ce311cb4ee5d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.1.16-tuxcare.7 of org.springframework:spring-messaging. not_affected \u2014 Target Spring Framework version 6.1.16-tuxcare.7 is NOT AFFECTED by CVE-2022-22971. The upstream fix (commit dc2947c52d) was already present in the Spring Framework 6.1.16 release that TuxCare onboarded. Both SimpleBrokerMessageHandler.java and StompBrokerRelayMessageHandler.java contain the duplicate CONNECT detection code that prevents the DoS vulnerability. The fix was authored by rstoyanche...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:9411280d-a912-5a1c-b434-6199e9cc5bc3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.1.16-tuxcare.7"
    }
  ]
}