{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4acb2466-96fa-5de3-8076-238437758295",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.1.18.RELEASE-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.1.18.RELEASE-tuxcare.2",
      "version": "5.1.18.RELEASE-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.1.18.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.1.18.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.18.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1fb88bea-3639-53e2-88c8-c338ed184193",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-messaging. CVE-2018-1270 (STOMP WebSocket RCE via SpEL injection) is NOT present in Spring Framework 5.1.18.RELEASE. The vulnerability involved using StandardEvaluationContext to evaluate SpEL expressions from untrusted STOMP subscription selector headers, allowing arbitrary method invocation. The fix (commit e0de9126, dated 2018-03-21) replaced StandardEvaluationContext with SimpleEvaluationContext and changed how the message object is passed to prevent method invocation attacks. This fix was authored by upstream (Rossen Stoyanchev @pivotal.io) and was already included in the upstream 5.1.18.RELEASE when TuxCare onboarded it. The target code uses SimpleEvaluationContext throughout, confirming the fix is present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.18.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:48953dde-0620-5c5a-8606-5683dfcd090b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework versions with STOMP over WebSocket that use StandardEvaluationContext for SpEL selector expression evaluation, allowing remote code execution. The target (5.1.18.RELEASE) is NOT AFFECTED because the upstream fix (commit e0de9126ed) was already present in the release when TuxCare onboarded it. The vulnerable StandardEvaluationContext has been replaced with SimpleEvaluationContext, preventing arbitrary Java reflection and method invocation through SpEL expressions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.18.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1dd5be91-8ffc-5921-bbb1-b2a4bb72524f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.18.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3ca7c0f8-ce17-58c8-b197-60b32294a742",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 5.1.18.RELEASE-tuxcare.2 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 5.1.18.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.1.18.RELEASE-tuxcare.2"
    }
  ]
}