{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a503f97c-5a79-53ed-aa7a-fb5fcd809e80",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.4",
      "version": "5.1.7.RELEASE-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.1.7.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:19aa64a2-386a-5ebd-9e16-c5e2136de13f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.1.7.RELEASE-tuxcare.4 of org.springframework:spring-messaging. CVE-2018-1270 is NOT present in Spring Framework 5.1.7.RELEASE. The vulnerability involved SpEL injection via STOMP subscription selectors using StandardEvaluationContext, which allowed arbitrary code execution. The upstream fix (commit e0de9126ed by rstoyanchev@pivotal.io, March 2018) replaced StandardEvaluationContext with SimpleEvaluationContext, restricting evaluation to safe property access only. This fix was already included in the upstream 5.1.7.RELEASE before TuxCare onboarded it (first TuxCare commit 11c2c0425a, Oct 2026). The target code shows SimpleEvaluationContext at line 69-70 and secure evaluation at line 226, confirming the vulnerable pattern is absent.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:47099c3f-3834-5f2b-be7c-53e74dab66a6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.1.7.RELEASE-tuxcare.4 of org.springframework:spring-messaging. The target repository (Spring Framework 5.1.7.RELEASE) is not affected by CVE-2018-1275. The vulnerability involves SpEL injection through STOMP message selectors evaluated with StandardEvaluationContext, which allows unrestricted access to Java reflection APIs enabling remote code execution. The upstream fix (commit e0de9126ed by rstoyanchev@pivotal.io, March 21, 2018) replaced StandardEvaluationContext with SimpleEvaluationContext to restrict expression evaluation and prevent access to Java types/methods. This fix was already present in the upstream 5.1.7.RELEASE when TuxCare onboarded it on September 2026. The vulnerable code pattern (StandardEvaluationContext) is not present in the target - only the secure SimpleEvaluationContext implementation exists.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:8f179530-386e-5227-9156-5b06fdcc798d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.7.RELEASE-tuxcare.4 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:c2e9c3e3-9d21-56bc-8333-5d5db34516d1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 5.1.7.RELEASE-tuxcare.4 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 5.1.7.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.4"
    }
  ]
}