{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b18f8e8d-4c9c-5043-9ff1-8d45ae60e549",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.1.20-tuxcare.13",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.1.20-tuxcare.13",
      "version": "6.1.20-tuxcare.13",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.1.20",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.20"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.20-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:03900a9a-c809-5c98-8e74-57f7b3cce5f3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.1.20-tuxcare.13 of org.springframework:spring-messaging. CVE-2018-1270 affects Spring Framework versions 5.0 < 5.0.5 and 4.3 < 4.3.16 due to SpEL injection via STOMP subscription selectors. The vulnerability was caused by using StandardEvaluationContext with the message as root object, allowing arbitrary code execution. The target version 6.1.20 is not affected because the upstream fix (switching to SimpleEvaluationContext) was applied in March 2018 and shipped in all subsequent Spring Framework releases including 6.1.20. TuxCare onboarded version 6.1.20 in June 2025, inheriting the fix from the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.20-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:8027a6bd-5726-5bd8-95e4-02d7070c1586",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.1.20-tuxcare.13 of org.springframework:spring-messaging. CVE-2018-1275 is NOT present in Spring Framework 6.1.20-tuxcare.13. The vulnerability involved using StandardEvaluationContext for SpEL expression evaluation in STOMP message selectors, which allowed remote code execution. The upstream fix (commit e0de9126ed8c, dated 2018-03-21) replaced StandardEvaluationContext with SimpleEvaluationContext and changed the evaluation pattern. This fix was already present in the upstream Spring Framework 6.1.20 release before TuxCare onboarded it. The target code uses SimpleEvaluationContext.forPropertyAccessors() (line 75-76) and passes the message as a parameter rather than root object (line 238), which prevents arbitrary method execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.20-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:ff3b590d-b0be-5890-87ee-7f1d81b57894",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.1.20-tuxcare.13 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 is not present in Spring Framework 6.1.20-tuxcare.13. The vulnerability allowed authenticated users to cause denial of service by sending duplicate STOMP CONNECT frames to already-connected sessions. The fix (checking for existing session before processing CONNECT frames) was implemented by the upstream Spring Framework team and shipped in the 6.1.20 release before TuxCare onboar...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.20-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:41befe06-8598-5208-bce8-9cf0f65bef0e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.20-tuxcare.13 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.1.20-tuxcare.13"
    }
  ]
}