{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a4bf4eaf-12bb-5606-8d26-7855c5784aff",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1",
      "version": "5.1.13.RELEASE-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.1.13.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:30bf94f6-2faa-5ee9-820d-cc54a0d99788",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging. The target Spring Framework 5.1.13.RELEASE already contains the fix for CVE-2018-1270. The vulnerability involved unsafe SpEL expression evaluation using StandardEvaluationContext in STOMP message selectors, allowing remote code execution. The fix (commit e0de9126, authored by rstoyanchev@pivotal.io on 2018-03-21) replaced StandardEvaluationContext with SimpleEvaluationContext, preventing arbitrary method invocation. This fix was already present in the upstream 5.1.13.RELEASE (released 2020-01-14) before TuxCare onboarded the version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b6e5e72d-8695-5566-9aaf-ff3a33bc5355",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging. CVE-2018-1275 (RCE via SpEL injection in STOMP message selectors) is NOT present in Spring Framework 5.1.13.RELEASE. The upstream fix (commit e0de9126 by Rossen Stoyanchev, March 2018) replaced StandardEvaluationContext with SimpleEvaluationContext, eliminating arbitrary code execution. This fix was already present in the upstream Spring Framework 5.1.13.RELEASE before TuxCare onboarded it (commit b3606223d9). The target uses SimpleEvaluationContext with restricted property access and passes messages as parameters (not root objects), matching the patched behavior exactly.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bea9a1b5-2c50-5646-8804-2b38c6b0d5cc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22971 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging, and is fixed in 5.1.13.RELEASE-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:81a770d1-4df7-5a39-96ee-5c901949a956",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 5.1.13.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE-tuxcare.1"
    }
  ]
}