{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:20a0b260-aeb6-5a45-b97d-cb50979f02f1",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.4",
      "version": "6.2.3-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.2.3",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:35b40723-13fb-5fc3-a6ee-446863441cbf",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.2.3-tuxcare.4 of org.springframework:spring-messaging. CVE-2018-1270 is not present in Spring Framework 6.2.3-tuxcare.4. The vulnerability involved unsafe use of StandardEvaluationContext for evaluating SpEL expressions in STOMP message selectors, enabling remote code execution. The upstream Spring Framework team fixed this in March 2018 (commit e0de9126ed) by replacing StandardEvaluationContext with SimpleEvaluationContext, which restricts expression evaluation to safe property accessors only. This fix was already present in the upstream 6.2.3 release that TuxCare onboarded in 2026, approximately 8 years after the original fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:698a41e2-1745-5d10-90a1-b5aa08048a2c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.2.3-tuxcare.4 of org.springframework:spring-messaging. CVE-2018-1275 is NOT present in Spring Framework 6.2.3. The vulnerability involves remote code execution through STOMP subscription selector expressions evaluated using StandardEvaluationContext, which allows arbitrary method invocation. The target version uses SimpleEvaluationContext instead, which restricts SpEL evaluation to property access only. The fix was authored by the upstream Spring Framework project (rstoyanchev@pivotal.io) and shipped in the upstream release before TuxCare began maintaining version 6.2.3. No vulnerable code patterns remain in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ca58ab9a-2e75-5581-b5e3-19944b311e38",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.2.3-tuxcare.4 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 does not affect Spring Framework 6.2.3. The vulnerability (denial of service via duplicate STOMP CONNECT frames) was fixed in upstream commit dc2947c52df by rstoyanchev@vmware.com on April 29, 2022. This fix was already included in the upstream Spring Framework 6.2.3 release when TuxCare onboarded it. Both affected files (SimpleBrokerMessageHandler.java and StompBrokerRelayMessag...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:f1998a14-4ea6-5339-9740-07ec68b5c6c1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.2.3-tuxcare.4 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.2.3-tuxcare.4"
    }
  ]
}