{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d8a8ce7c-9a59-5f57-a614-58eab9886ebe",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.2.1-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.2.1-tuxcare.6",
      "version": "6.2.1-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.2.1",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.1"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.1-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:48602b3c-f1c2-52ad-baee-9368b4b0608a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-messaging. CVE-2018-1270 is NOT present in Spring Framework 6.2.1. The vulnerability involved remote code execution through malicious SpEL expressions in STOMP message selectors, exploiting StandardEvaluationContext's full reflection capabilities. The fix replaced StandardEvaluationContext with SimpleEvaluationContext, restricting SpEL to property access only. This upstream fix (commit e0de9126ed by Rossen Stoyanchev, March 21, 2018) was already present in the upstream release that TuxCare onboarded for version 6.2.1, predating the first TuxCare commit by 15,350 commits. The target uses SimpleEvaluationContext throughout, with no remaining StandardEvaluationContext usage in the spring-messaging module.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.1-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:8eb4d77e-4d83-5e85-a97c-595dad3f8406",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-messaging. CVE-2018-1275 is NOT present in Spring Framework 6.2.1-tuxcare.6. The vulnerability (RCE via malicious STOMP selector expressions evaluated with StandardEvaluationContext) was fixed by upstream Spring Framework in March 2018 (commit e0de9126ed by Rossen Stoyanchev). This fix was already included in the upstream 6.2.1 release that TuxCare onboarded. The target code uses SimpleEvaluationContext (restricted) instead of StandardEvaluationContext (allows full reflection), preventing arbitrary code execution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.1-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:3908d84c-7df6-5e8a-808f-b90a2fdea27c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.2.1-tuxcare.6 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 affects Spring Framework versions prior to 5.3.20+ and 5.2.22+, allowing authenticated users to perform denial of service attacks via duplicate STOMP CONNECT frames. The target repository (Spring Framework 6.2.1-tuxcare.6) is NOT affected because the upstream fix was already present in the 6.2.1 release before TuxCare onboarded it. The defensive code that ignores duplicate CONNEC...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.1-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:a96aaf55-1692-5d6d-b723-a9040ac9e585",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.2.1-tuxcare.6 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.2.1-tuxcare.6"
    }
  ]
}