{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:54dd583b-99f8-5099-8f82-588c43a2a251",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@4.0.0.RELEASE-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@4.0.0.RELEASE-tuxcare.4",
      "version": "4.0.0.RELEASE-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@4.0.0.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.0.0.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:a107ac18-f3de-5cdd-9d4c-904f1eda2eee",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-messaging. The version is not vulnerable. [terminalized not_affected from patch_application_manual/not_vulnerable]",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:542ae823-fcce-5169-a4d3-6c570c49f01f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-messaging. Spring Framework 4.0.0.RELEASE is not affected by CVE-2018-1275. The vulnerability requires the SpEL-based selector feature for STOMP subscription filtering, which was introduced in version 4.2.0.RC1 (April 2015). Version 4.0.0 (released 2013) predates this feature entirely. Exhaustive searches confirm no selector expression evaluation code exists in the spring-messaging module.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:42cf6e63-b539-550e-a5c4-3d7c7e1b9166",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:63e33776-79bd-59f5-8a10-35304dfe7815",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.0.0.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@4.0.0.RELEASE-tuxcare.4"
    }
  ]
}