{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a2ed1874-29f5-5e73-9bc8-f58e32b563ae",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.0.13.RELEASE-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.0.13.RELEASE-tuxcare.6",
      "version": "5.0.13.RELEASE-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.0.13.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.0.13.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.0.13.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:249acdc6-a8b8-541e-b051-4140081cdc20",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging. CVE-2018-1270 is NOT present in Spring Framework 5.0.13.RELEASE. The vulnerability affects versions 5.0 prior to 5.0.5 and was fixed in the upstream release v5.0.5.RELEASE (March 2018) by replacing StandardEvaluationContext with SimpleEvaluationContext to prevent arbitrary code execution through SpEL expressions in STOMP message selectors. The target version (5.0.13.RELEASE, 8 releases after the fix) already contains the complete mitigation from the upstream vendor.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.0.13.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:e20c2173-c1a3-5dda-9268-1ca8f1dd21d3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging. CVE-2018-1275 is not present in Spring Framework 5.0.13.RELEASE. The vulnerability involved unsafe SpEL expression evaluation using StandardEvaluationContext, which allowed remote code execution through crafted STOMP subscription selectors. The upstream fix (commit e0de9126ed by Rossen Stoyanchev) replaced StandardEvaluationContext with SimpleEvaluationContext and changed message handling to prevent reflection-based attacks. This fix was already included in upstream 5.0.13.RELEASE before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.0.13.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:4c36d4ac-d860-5655-b167-0889a5b3a6ef",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.0.13.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:384c473f-2adb-5834-9667-0c543ffe57ad",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 5.0.13.RELEASE-tuxcare.6 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 5.0.13.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.0.13.RELEASE-tuxcare.6"
    }
  ]
}