{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:84f836f1-1e62-5964-99fa-e7a6f2265721",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.11",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.11",
      "version": "4.3.30.RELEASE-tuxcare.11",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.3.30.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:5dae6fec-1d5f-597a-b0c9-a4fdd97e050b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 4.3.30.RELEASE-tuxcare.11 of org.springframework:spring-messaging. CVE-2018-1270 is not present in the target Spring Framework 4.3.30.RELEASE. The vulnerability involves SpEL expression injection through STOMP message selectors using StandardEvaluationContext, which allows remote code execution. The target contains the upstream fix (commit 0009806) that replaced StandardEvaluationContext with SimpleEvaluationContext, restricting SpEL evaluation to safe property access only. This fix was shipped in the upstream 4.3.16 release (prior to 4.3.30) and was already present before TuxCare maintenance began. Version 4.3.30 is well after the first patched version (4.3.16), confirming the vulnerable code pattern is absent.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:32868c92-162a-574c-8316-cb7fddde975d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 4.3.30.RELEASE-tuxcare.11 of org.springframework:spring-messaging. The target Spring Framework 4.3.30.RELEASE-tuxcare.11 is NOT AFFECTED by CVE-2018-1275. The vulnerability (unrestricted SpEL expression evaluation via StandardEvaluationContext allowing remote code execution) was fixed in upstream version 4.3.16.RELEASE. The fix commit (0009806debb578e884f6dc98bd1f2dc668020021) by Rossen Stoyanchev replaced StandardEvaluationContext with SimpleEvaluationContext in DefaultSubscriptionRegistry.java, restricting SpEL evaluation to property access only. This fix was already present in the upstream 4.3.30.RELEASE that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit (0afd3c6d7c8002a03a60b8bfd86b8709130fdb82). The current code uses the secure SimpleEvaluationContext pattern with no vulnerable StandardEvaluationContext usage remaining.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:36005253-71a7-51b2-911e-6f860c22062c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.30.RELEASE-tuxcare.11 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:11ca3974-3b62-5c0b-a474-2089b0806c60",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 4.3.30.RELEASE-tuxcare.11 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 4.3.30.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@4.3.30.RELEASE-tuxcare.11"
    }
  ]
}