{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d0b583f8-3e24-56da-81bd-3fc4cebfd1eb",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.12",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.12",
      "version": "5.2.13.RELEASE-tuxcare.12",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.2.13.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:3eb031bc-9305-56c0-b91c-ed950de50258",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.2.13.RELEASE-tuxcare.12 of org.springframework:spring-messaging. CVE-2018-1270 is not present in spring-framework 5.2.13.RELEASE. The vulnerability required StandardEvaluationContext for SpEL expression evaluation in STOMP message selectors, which allowed arbitrary code execution. The target uses SimpleEvaluationContext (introduced in upstream commit e0de9126ed on 2018-03-21), which restricts access to Java classes and prevents RCE. This fix was already in the upstream 5.2.13.RELEASE when TuxCare onboarded it in 2025-09-10, making the target version never vulnerable to this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:fc76393c-f6c8-563b-9679-27fd012daf75",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.2.13.RELEASE-tuxcare.12 of org.springframework:spring-messaging. CVE-2018-1275 is not present in Spring Framework 5.2.13.RELEASE. The vulnerability involved using StandardEvaluationContext for STOMP message selector expression evaluation, allowing RCE via crafted SpEL expressions. The upstream fix (commit e0de9126ed from March 2018) replaced StandardEvaluationContext with SimpleEvaluationContext, restricting SpEL to safe property-access-only operations. This fix shipped in Spring 5.0.5+ and all 5.2.x releases. Target version 5.2.13.RELEASE contains the upstream fix; no vulnerable code pattern exists.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:06cb57f4-ebd0-5f50-852a-2ba6bd017dd1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.12 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:dc15bd2e-cd96-597f-8807-2fe7e17322ba",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.13.RELEASE-tuxcare.12 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.2.13.RELEASE-tuxcare.12"
    }
  ]
}