{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:2f600398-6fe5-59a6-b87a-440c456b1cc4",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@4.3.27.RELEASE-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@4.3.27.RELEASE-tuxcare.2",
      "version": "4.3.27.RELEASE-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@4.3.27.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.27.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.27.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fd3934ec-8592-5e61-873d-c9b48c9a7523",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 4.3.27.RELEASE-tuxcare.2 of org.springframework:spring-messaging. CVE-2018-1270 affects Spring Framework versions 4.3 < 4.3.16 and 5.0 < 5.0.5 via SpEL injection in STOMP subscription selectors. The target version 4.3.27.RELEASE already contains the upstream fix (commit 0009806deb) that replaced vulnerable StandardEvaluationContext with SimpleEvaluationContext in DefaultSubscriptionRegistry.java, eliminating the RCE attack vector. The fix was authored by rstoyanchev@pivotal.io and shipped in the upstream 4.3.16+ releases before TuxCare onboarded version 4.3.27.RELEASE.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.27.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e06de872-547d-50df-a7a3-529a1bbb8366",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 4.3.27.RELEASE-tuxcare.2 of org.springframework:spring-messaging. Spring Framework 4.3.27.RELEASE is NOT AFFECTED by CVE-2018-1275. The vulnerability requires StandardEvaluationContext for SpEL evaluation in STOMP message selector headers, enabling RCE via arbitrary method invocation. The target uses SimpleEvaluationContext instead (DefaultSubscriptionRegistry.java:67-69), which restricts evaluation to property access only and blocks the attack vector. This fix was introduced by upstream commit 0009806deb (Rossen Stoyanchev, Pivotal) and was already present in the upstream 4.3.27.RELEASE that TuxCare onboarded. The CVE affected versions \"4.3 prior to 4.3.16\"; this is version 4.3.27, well after the fix threshold.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.27.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b5dead30-cf55-5b0b-9429-627589670e52",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.27.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.27.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fed8576e-6a9e-52b3-bdd1-c1c6a4b446e2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 4.3.27.RELEASE-tuxcare.2 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.3.27.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@4.3.27.RELEASE-tuxcare.2"
    }
  ]
}