{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:baa8c26d-8a6c-5f53-ad96-815d8b2c89e1",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.7",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.7",
      "version": "4.3.25.RELEASE-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.25.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:be51de75-f026-5d34-b5ed-9535c7c962a9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-messaging. CVE-2018-1270 is not present in Spring Framework 4.3.25.RELEASE. The vulnerability involved using StandardEvaluationContext for SpEL expression evaluation in STOMP message selectors, allowing arbitrary code execution. The upstream fix (commit 0009806deb by rstoyanchev@pivotal.io) replaced StandardEvaluationContext with SimpleEvaluationContext, which restricts evaluation to property access only. This fix was already included in the upstream 4.3.25.RELEASE that TuxCare onboarded, making the target immune to this vulnerability.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:af1889ab-3f83-53d8-b443-e1f66da50bdc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-messaging. The target Spring Framework 4.3.25.RELEASE is not affected by CVE-2018-1275. The vulnerability (remote code execution via SpEL injection using StandardEvaluationContext in STOMP message selector expressions) was fixed by the upstream Spring Framework team in commit 0009806deb (April 9, 2018) by replacing StandardEvaluationContext with the restricted SimpleEvaluationContext. This fix was already present in the upstream 4.3.25.RELEASE when TuxCare onboarded the version. The vulnerable code pattern is not present in the target.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:082078bc-2198-54e7-a173-d54b6aba322c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:c8e78a02-97af-5275-b262-76e60b2f7d60",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 4.3.25.RELEASE-tuxcare.7 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.3.25.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE-tuxcare.7"
    }
  ]
}