{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:11432fbf-d7d7-55de-a4b1-10831ea77672",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.2.0.RELEASE-tuxcare.8",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.2.0.RELEASE-tuxcare.8",
      "version": "5.2.0.RELEASE-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.2.0.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.2.0.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.0.RELEASE-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:d7b6f8c3-280b-5b9d-94cb-8ad786cd2384",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.2.0.RELEASE-tuxcare.8 of org.springframework:spring-messaging. CVE-2018-1270 targets remote code execution via SpEL expression evaluation in STOMP message selectors. The vulnerability requires StandardEvaluationContext with user-controlled message as the root object, enabling arbitrary method invocation. The target Spring Framework 5.2.0.RELEASE already contains the upstream fix (commit e0de9126ed) that replaces StandardEvaluationContext with SimpleEvaluationContext, restricting SpEL to safe property access only. This fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) and shipped in the upstream 5.2.0.RELEASE before TuxCare onboarding. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.0.RELEASE-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:813b4da6-d901-5c14-97c9-38e75e6290e1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.2.0.RELEASE-tuxcare.8 of org.springframework:spring-messaging. CVE-2018-1275 is NOT present in Spring Framework 5.2.0.RELEASE-tuxcare.8. The vulnerability was fixed by the upstream vendor (Pivotal/Spring) in commit e0de9126 (March 21, 2018) by replacing StandardEvaluationContext with SimpleEvaluationContext in DefaultSubscriptionRegistry. This fix was already included in the upstream 5.2.0.RELEASE (September 2019) before TuxCare onboarded it. The CVE affects \"versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16\" - version 5.2.0.RELEASE is much newer and was never vulnerable. The target code uses SimpleEvaluationContext with restricted property access, preventing the SpEL-based RCE attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.0.RELEASE-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:32be86cf-f838-54ac-82f0-d2dbdb883634",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.0.RELEASE-tuxcare.8 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.0.RELEASE-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:e00476d6-943e-5f7b-88bb-f275e5a59beb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.0.RELEASE-tuxcare.8 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.2.0.RELEASE-tuxcare.8"
    }
  ]
}