{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a9bbcdbe-6d7e-516c-81a9-c344cd28098f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@4.3.21.RELEASE-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@4.3.21.RELEASE-tuxcare.3",
      "version": "4.3.21.RELEASE-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@4.3.21.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.21.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.21.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:48fac4fa-7848-54be-8fe2-59a4e96a1d7e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-messaging. CVE-2018-1270 is not present in Spring Framework 4.3.21.RELEASE. The vulnerability involved unsafe SpEL expression evaluation using StandardEvaluationContext which allowed arbitrary method invocation via crafted message selectors. The target code contains the upstream security fix (commit 0009806de) that replaced StandardEvaluationContext with SimpleEvaluationContext, restricting evaluation to property access only and preventing code execution. This fix was shipped in the upstream 4.3.21.RELEASE before TuxCare onboarded the version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.21.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:90393af9-c610-5a09-bcc6-560770933683",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-messaging. The target Spring Framework 4.3.21.RELEASE-tuxcare.3 is not affected by CVE-2018-1275. The vulnerability exploited StandardEvaluationContext in DefaultSubscriptionRegistry to achieve RCE through SpEL injection in STOMP message selectors. The target uses SimpleEvaluationContext (lines 68-69), which restricts property access and prevents arbitrary method invocation. The fix was authored by upstream developer Rossen Stoyanchev (rstoyanchev@pivotal.io) in commit 0009806deb and shipped in Spring 4.3.16, before the target's 4.3.21 base version. No StandardEvaluationContext usage exists in the spring-messaging module.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.21.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:65b78def-9718-5012-862c-50665727e19a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.21.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:d411c860-dac3-52f9-a640-d59bef697012",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.3.21.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@4.3.21.RELEASE-tuxcare.3"
    }
  ]
}