{
  "@id": "urn:uuid:521b221b-3570-4731-9c1a-222fed13ca3d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 45,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:12:34.459172+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2018-1270 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-messaging. CVE-2018-1270 is NOT present in Spring Framework 5.3.39. The vulnerability involved unsafe SpEL expression evaluation using StandardEvaluationContext in STOMP message selector processing, enabling remote code execution. The target repository contains the upstream fix (commit e0de9126ed8cf25cf141d3e66420da94e350708a) that replaced StandardEvaluationContext with the restricted SimpleEvaluationContext. This fix was authored by the Spring Framework team (rstoyanchev@pivotal.io) and shipped in v5.0.5.RELEASE, which predates all TuxCare work on this branch. The vulnerable pattern is absent from the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1270"
      },
      "impact_statement": "CVE-2018-1270 is NOT present in Spring Framework 5.3.39. The vulnerability involved unsafe SpEL expression evaluation using StandardEvaluationContext in STOMP message selector processing, enabling remote code execution. The target repository contains the upstream fix (commit e0de9126ed8cf25cf141d3e66420da94e350708a) that replaced StandardEvaluationContext with the restricted SimpleEvaluationContext. This fix was authored by the Spring Framework team (rstoyanchev@pivotal.io) and shipped in v5.0.5.RELEASE, which predates all TuxCare work on this branch. The vulnerable pattern is absent from the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2018-1275 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework versions 5.0 prior to 5.0.5 through SpEL injection in DefaultSubscriptionRegistry. The target (Spring Framework 5.3.39-tuxcare.23) is NOT vulnerable. The fix was already present in the upstream v5.3.39 release, introduced by commit e0de9126 (authored by rstoyanchev@pivotal.io on 2018-03-21). The target uses SimpleEvaluationContext instead of the vulnerable StandardEvaluationContext, and passes messages as parameters rather than root objects, preventing arbitrary code execution through SpEL expressions in STOMP selector headers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1275"
      },
      "impact_statement": "CVE-2018-1275 affects Spring Framework versions 5.0 prior to 5.0.5 through SpEL injection in DefaultSubscriptionRegistry. The target (Spring Framework 5.3.39-tuxcare.23) is NOT vulnerable. The fix was already present in the upstream v5.3.39 release, introduced by commit e0de9126 (authored by rstoyanchev@pivotal.io on 2018-03-21). The target uses SimpleEvaluationContext instead of the vulnerable StandardEvaluationContext, and passes messages as parameters rather than root objects, preventing arbitrary code execution through SpEL expressions in STOMP selector headers.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-11-02T02:05:00.140309+00:00",
      "status_notes": "Vulnerability CVE-2022-22971 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 is NOT present in the target. The fix for this DoS vulnerability (duplicate STOMP CONNECT frame handling) was already included in the upstream Spring Framework v5.3.39 release that TuxCare onboarded. Both SimpleBrokerMessageHandler and StompBrokerRelayMessageHandler contain the required session-existence checks that prevent duplicate session creation. Fix commit dc2947c52d by ups...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22971"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22971 is NOT present in the target. The fix for this DoS vulnerability (duplicate STOMP CONNECT frame handling) was already included in the upstream Spring Framework v5.3.39 release that TuxCare onboarded. Both SimpleBrokerMessageHandler and StompBrokerRelayMessageHandler contain the required session-existence checks that prevent duplicate session creation. Fix commit dc2947c52d by ups..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.21",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.39-tuxcare.21"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47888 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-messaging.",
      "vulnerability": {
        "name": "CVE-2026-47888"
      }
    }
  ]
}