{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8c73e288-0f4d-5dde-af2c-aa006aba1ccd",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.2.15-tuxcare.8",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.2.15-tuxcare.8",
      "version": "6.2.15-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.2.15",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.15"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.15-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:fbc5a937-9f34-5c1c-ad99-0dac47bfff9c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-messaging. Target Spring Framework 6.2.15 is not affected by CVE-2018-1270. The vulnerability was fixed in the upstream Spring Framework release in March 2018 (commit e0de9126, versions 5.0.5 and 4.3.16). The fix replaced the vulnerable StandardEvaluationContext with SimpleEvaluationContext, preventing remote code execution through malicious SpEL expressions in STOMP message selectors. This upstream fix was already present in version 6.2.15 when TuxCare onboarded it in July 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.15-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:50674864-d363-5d06-8e60-1b62428da044",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework versions using StandardEvaluationContext for STOMP selector header evaluation, allowing remote code execution via malicious SpEL expressions. The target (Spring Framework 6.2.15) is NOT AFFECTED because the upstream fix (commit e0de9126ed from March 2018) was already present in the release when TuxCare onboarded it in July 2026. The fix replaces StandardEvaluationContext with SimpleEvaluationContext, which restricts SpEL to property-access-only mode, preventing constructor invocation and method calls. Additionally, Spring Framework 6.1+ disables selector support by default, providing defense-in-depth.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.15-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:9be7c92a-ce43-5545-bf51-609e2476cb56",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 is NOT present in Spring Framework 6.2.15-tuxcare.8. The vulnerability (DoS via duplicate STOMP CONNECT frames on already-connected sessions) was fixed in upstream commit dc2947c52df18d5e99cad03383f7d6ba13d031fd by rstoyanchev@vmware.com. This fix was already included in the upstream Spring Framework 6.2.15 release that TuxCare onboarded. Both SimpleBrokerMessageHandler.java and ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.15-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:62f9632d-edff-54b2-a185-5558d56a24c3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.2.15-tuxcare.8"
    }
  ]
}