{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8c526ac2-2da1-5db3-87a7-96b3edb86985",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.1.8.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.1.8.RELEASE-tuxcare.1",
      "version": "5.1.8.RELEASE-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.1.8.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.1.8.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.8.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:874b74cb-648e-5332-bdd5-2259eb8c1d6e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-messaging. Spring Framework 5.1.8.RELEASE is NOT vulnerable to CVE-2018-1270. The target contains the upstream vendor fix that replaced StandardEvaluationContext with SimpleEvaluationContext, preventing SpEL expression injection attacks in STOMP over WebSocket. This fix was committed by Rossen Stoyanchev (rstoyanchev@pivotal.io) on March 21, 2018 and shipped in the upstream 5.1.8.RELEASE in June 2019, before TuxCare onboarded the version in September 2026. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.8.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fcb5578b-764e-5b5b-a35f-6767810ff74d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-messaging. CVE-2018-1275 is not present in Spring Framework 5.1.8.RELEASE. The vulnerability (remote code execution via unrestricted SpEL evaluation in STOMP subscription selectors) was fixed by upstream Spring in March 2018 (commit e0de9126) by replacing StandardEvaluationContext with SimpleEvaluationContext. This fix was already included in the upstream 5.1.8.RELEASE (June 2019) that TuxCare onboarded, over a year after the fix was committed. The target code uses SimpleEvaluationContext exclusively with no StandardEvaluationContext present anywhere in the spring-messaging module.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.8.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b778852a-559f-5a2e-b6be-eb79564de3fb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.8.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:651f3d23-d8fe-5dd6-a6a8-f75a4450b66f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 5.1.8.RELEASE-tuxcare.1 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 5.1.8.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.1.8.RELEASE-tuxcare.1"
    }
  ]
}