{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f6e0192b-294d-587a-a58f-ec03b13cea23",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.2.10.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.2.10.RELEASE-tuxcare.1",
      "version": "5.2.10.RELEASE-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.2.10.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.2.10.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.10.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c91bfc89-cba2-581c-9c7a-c2be4ea9d943",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-messaging. CVE-2018-1270 is not present in Spring Framework 5.2.10.RELEASE. The vulnerability was fixed in upstream commit e0de9126ed (March 2018) which replaced StandardEvaluationContext with SimpleEvaluationContext to prevent arbitrary code execution via SpEL selector expressions in STOMP subscriptions. This fix was already included in the upstream 5.2.10.RELEASE (October 2020) when TuxCare onboarded it in September 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.10.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:661efb61-ee74-5516-ba1f-7a151e4c4896",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-messaging. Spring Framework 5.2.10.RELEASE is not affected by CVE-2018-1275. The vulnerability involves SpEL injection through STOMP message selectors when using StandardEvaluationContext with the message as root object, allowing remote code execution. The upstream fix (commit e0de9126ed, March 2018) replaced StandardEvaluationContext with SimpleEvaluationContext and changed evaluation to pass the message as a parameter rather than root object. This fix was already included in upstream Spring Framework 5.2.0.RELEASE and all subsequent 5.2.x releases. When TuxCare onboarded version 5.2.10.RELEASE in September 2026, the fix was already present. The target code correctly uses SimpleEvaluationContext with restricted property access throughout, with no StandardEvaluationContext usage found anywhere in the spring-messaging module.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.10.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e85f2db7-836e-55df-8560-5cf22416f7d5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22971 affects version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.10.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f51000c7-6a33-5aa2-93fb-1446914691e1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.10.RELEASE-tuxcare.1 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.2.10.RELEASE-tuxcare.1"
    }
  ]
}