{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:fc312e1d-099c-5abd-aa7c-70f6f20c4e9e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.9",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.9",
      "version": "6.1.4-tuxcare.9",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.1.4",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.4"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:de4f2f5b-f7b9-5d3f-a495-dff071acd914",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.1.4-tuxcare.9 of org.springframework:spring-messaging. CVE-2018-1270 is NOT present in Spring Framework 6.1.4-tuxcare.9. The vulnerability (RCE via SpEL injection in STOMP selector expressions) requires StandardEvaluationContext with message as root object. The target uses SimpleEvaluationContext with message passed as parameter (line 238: expression.getValue(messageEvalContext, message, Boolean.class)), which prevents arbitrary method invocation. This fix was authored by upstream Spring developer Juergen Hoeller (jhoeller@pivotal.io, commit 51c57d77d9) and was already present in Spring Framework 6.1.4 when TuxCare onboarded it (onboarding commit 7aff8eb6f). The target version (6.1.4, released ~6 years after the CVE) is far beyond the affected versions (5.0 < 5.0.5, 4.3 < 4.3.16).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:1206e850-15eb-53db-9658-d4c91127321c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.1.4-tuxcare.9 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework versions 4.3 prior to 4.3.16 and 5.0 prior to 5.0.5. The target version 6.1.4-tuxcare.9 already contains the upstream fix (commit e0de9126ed, March 2018) which replaced the vulnerable StandardEvaluationContext with SimpleEvaluationContext. The vulnerable code pattern (SpEL expression evaluation with unrestricted context allowing arbitrary method invocation) is not present. The fix was shipped in the upstream Spring Framework 6.1.4 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:6a6604fa-e854-525c-8374-21122a8f9f48",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.1.4-tuxcare.9 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 is NOT present in Spring Framework 6.1.4. The vulnerability allowed authenticated users to cause denial of service by repeatedly sending STOMP CONNECT frames for already-connected sessions. The upstream fix (commit dc2947c52df18d5e99cad03383f7d6ba13d031fd by rstoyanchev@vmware.com, dated 2022-04-29) was already included in the upstream Spring Framework 6.1.4 release before TuxCar...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:4a504f75-e72e-51ee-a7e4-9130fae0fb7a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.4-tuxcare.9 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.1.4-tuxcare.9"
    }
  ]
}