{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:376d17ff-3deb-5b69-a354-04f83128f28d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.1.1.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.1.1.RELEASE-tuxcare.1",
      "version": "5.1.1.RELEASE-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.1.1.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.1.1.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.1.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b2238539-4be3-55ce-8368-797a651fff09",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-messaging. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.1.1.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-p5hg-3xm3-gcjg (affected up to 5.0.5.RELEASE), NVD (affected up to 5.0.5), CVE record (affected up to 5.0.5), Snyk (affected up to 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.1.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cffa37ff-98dc-5a04-8bb0-dbc66eb19fa1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-messaging. The target repository (Spring Framework 5.1.1.RELEASE) is not affected by CVE-2018-1275. The vulnerable code pattern (using StandardEvaluationContext with message as root object for SpEL expression evaluation in STOMP message selectors) is not present. The upstream fix (commit e0de9126ed8cf25cf141d3e66420da94e350708a) was included in Spring Framework v5.0.5.RELEASE (March 2018) and is present in all subsequent versions including v5.1.1.RELEASE. The fix replaces StandardEvaluationContext with SimpleEvaluationContext to prevent arbitrary code execution through malicious selector expressions.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.1.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2c79859a-cc59-5fc0-86ad-1037cd23e35f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.1.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6b36ee9c-157f-50c6-8bd6-99925ee022b3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-messaging. Prechecker: No vulnerable code from the fix was found; the vulnerable lines are absent, this version declares none of the classes the fix changes, and their base package is absent. Version 5.1.1.RELEASE is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.1.1.RELEASE-tuxcare.1"
    }
  ]
}