{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6bcc6e15-b8f4-514c-8ce3-e1d78e0b8f47",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.0.5.RELEASE-tuxcare.7",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.0.5.RELEASE-tuxcare.7",
      "version": "5.0.5.RELEASE-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.0.5.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.0.5.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.0.5.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:30da9bc6-e76e-5523-8f12-21c4e6f9b2d4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-messaging. CVE-2018-1270 affects Spring Framework versions 5.0 prior to 5.0.5 through unsafe SpEL expression evaluation using StandardEvaluationContext in STOMP subscription selectors, enabling remote code execution. The target repository at version 5.0.5.RELEASE contains the upstream security fix (commit e0de9126ed) that replaced StandardEvaluationContext with SimpleEvaluationContext. This fix was already present in the upstream 5.0.5.RELEASE when TuxCare onboarded it. The vulnerable code pattern is not present in the target. Exhaustive search confirmed zero occurrences of StandardEvaluationContext in the spring-messaging module. The target uses the secure SimpleEvaluationContext which restricts SpEL evaluation to only configured property accessors, preventing arbitrary Java class/method access.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.0.5.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:a1471c50-217d-528d-9c17-20b9587b1e58",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-messaging. The target is NOT vulnerable to CVE-2018-1275. The vulnerability was fixed in upstream Spring Framework 5.0.5.RELEASE, which is the exact version this target is based on. The fix (commit e0de9126ed8cf25cf141d3e66420da94e350708a by Rossen Stoyanchev) replaced StandardEvaluationContext with SimpleEvaluationContext to prevent RCE via malicious SpEL expressions in STOMP subscription selectors. The vulnerable code pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.0.5.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:536e397c-8942-58e4-b6ab-c943f4afe2a8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.0.5.RELEASE-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:c99cef05-5b69-5106-ab1d-b2a68ece76d0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 5.0.5.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.0.5.RELEASE-tuxcare.7"
    }
  ]
}