{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:78c044bc-9b14-508e-ba53-c6ce41c2b67f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.2.14-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.2.14-tuxcare.3",
      "version": "6.2.14-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.2.14",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.14"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.14-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:16504efa-db3f-52e4-b5ac-9f8a5f1da41a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.2.14-tuxcare.3 of org.springframework:spring-messaging. Target Spring Framework 6.2.14-tuxcare.3 is NOT AFFECTED by CVE-2018-1270 (SpEL injection RCE in STOMP subscriptions). The upstream vendor (Spring/VMware) fixed this vulnerability in March 2018 by replacing StandardEvaluationContext with SimpleEvaluationContext in DefaultSubscriptionRegistry.java. This fix (commit e0de9126) was already included in the Spring Framework 6.2.14 release that TuxCare onboarded, eliminating the vulnerable code pattern before any TuxCare modifications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.14-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:7eb80a68-5a4a-5ce0-be16-425ca0a93ff7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.2.14-tuxcare.3 of org.springframework:spring-messaging. CVE-2018-1275: Spring Framework 6.2.14 is NOT AFFECTED. The vulnerability required StandardEvaluationContext to enable arbitrary Java code execution through SpEL expressions in STOMP subscription selectors. The target uses SimpleEvaluationContext instead (line 75-76 of DefaultSubscriptionRegistry.java), which restricts evaluation to property access only, preventing code execution. The fix was applied by upstream Spring Framework in commit e0de9126ed (2018-03-21) by Rossen Stoyanchev and was already present in the upstream 6.2.14 release when TuxCare onboarded it (commit 4bc6674c9c). Additionally, the SpEL selector feature is disabled by default in Spring Framework 6.1+ as defense-in-depth.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.14-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:3b9e5487-8046-50a6-bb67-0ce07e30bc12",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.2.14-tuxcare.3 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 (STOMP over WebSocket DoS) is not present in Spring Framework 6.2.14. The upstream fix (commit dc2947c52d) was already included in the 6.2.14 release. Both SimpleBrokerMessageHandler and StompBrokerRelayMessageHandler now check for existing sessions before processing duplicate CONNECT frames, preventing the denial of service attack.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.14-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:9fdaba74-b7c1-5e8a-b246-74bd8b82e223",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.2.14-tuxcare.3 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.2.14-tuxcare.3"
    }
  ]
}