{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:506fae2d-bdd3-5a18-8a09-9197fe624176",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@4.3.26.RELEASE-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@4.3.26.RELEASE-tuxcare.4",
      "version": "4.3.26.RELEASE-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@4.3.26.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.26.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.26.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:0743108d-984b-509f-acc3-a10b422ff2d3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 4.3.26.RELEASE-tuxcare.4 of org.springframework:spring-messaging. CVE-2018-1270 is not present in Spring Framework 4.3.26.RELEASE. The vulnerability involved unsafe SpEL expression evaluation using StandardEvaluationContext with attacker-controlled input, allowing remote code execution. The fix (commit 0009806debb) replaced StandardEvaluationContext with SimpleEvaluationContext to restrict SpEL capabilities. This fix was already present in the upstream Spring Framework 4.3.26.RELEASE when TuxCare onboarded it (first TuxCare commit 217826c3). The target code uses the safe SimpleEvaluationContext and passes messages as parameters rather than as root objects, preventing arbitrary code execution. No StandardEvaluationContext usage exists in the spring-messaging module.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.26.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:095a803f-5e59-5771-bf99-0104d61ac0a4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 4.3.26.RELEASE-tuxcare.4 of org.springframework:spring-messaging. The target Spring Framework 4.3.26.RELEASE is NOT AFFECTED by CVE-2018-1275. The vulnerability was fixed in upstream Spring Framework 4.3.16 and the fix was already present in the 4.3.26.RELEASE version when TuxCare onboarded it. The vulnerable StandardEvaluationContext usage in DefaultSubscriptionRegistry has been replaced with SimpleEvaluationContext, preventing SpEL injection attacks through STOMP subscription selectors.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.26.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:73afc5c1-2b38-5977-8495-493e27447cbd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.26.RELEASE-tuxcare.4 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.26.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:a05cabc1-2f33-500a-8b40-efec23ca5ee6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 4.3.26.RELEASE-tuxcare.4 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.3.26.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@4.3.26.RELEASE-tuxcare.4"
    }
  ]
}