{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:fa674aa9-8f79-5068-9a9c-51ef5f5c4c89",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.1.19-tuxcare.5",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.1.19-tuxcare.5",
      "version": "6.1.19-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.1.19",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.19"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.19-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:dfdbed06-ad32-5465-ac47-c9190ea89f4e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.1.19-tuxcare.5 of org.springframework:spring-messaging. CVE-2018-1270 is NOT present in Spring Framework 6.1.19-tuxcare.7. The vulnerability involved arbitrary code execution through malicious SpEL expressions in STOMP message selectors due to use of StandardEvaluationContext. The target code uses SimpleEvaluationContext (the secure version), indicating the upstream fix from March 2018 (commit e0de9126ed) is present. This fix was already included in upstream release v5.0.5.RELEASE (April 2018), over 1 major version before the target version 6.1.19. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.19-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:9a15f5c2-175c-52b3-9e7a-d1528bc8202c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.1.19-tuxcare.5 of org.springframework:spring-messaging. The target Spring Framework 6.1.19-tuxcare.7 is NOT vulnerable to CVE-2018-1275. The vulnerable pattern (StandardEvaluationContext allowing arbitrary code execution via SpEL expressions in STOMP message selectors) is not present. The upstream fix was applied by Rossen Stoyanchev (rstoyanchev@pivotal.io) in commit e0de9126ed in March 2018 for Spring 5.0.5. This fix, which replaced StandardEvaluationContext with the restricted SimpleEvaluationContext, was already present in the upstream Spring 6.1.19 release that TuxCare onboarded. The target uses SimpleEvaluationContext.forPropertyAccessors() at line 76, preventing arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.19-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:095a7d06-5a06-5040-ab4d-592ff56907d7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.1.19-tuxcare.5 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 (STOMP over WebSocket DoS via duplicate CONNECT frames) is NOT present in Spring Framework 6.1.19-tuxcare.6. The vulnerability was fixed by upstream Spring Framework in commit dc2947c52d (author: rstoyanchev@vmware.com) before TuxCare onboarded this version. Both SimpleBrokerMessageHandler.java and StompBrokerRelayMessageHandler.java contain the upstream fix that checks for exist...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.19-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:61429441-d53a-5c83-bd73-d662dfc05549",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.19-tuxcare.5 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.1.19-tuxcare.5"
    }
  ]
}