{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:24d6437a-63d3-5dc7-942a-d883a3703144",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.2.15.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.2.15.RELEASE-tuxcare.1",
      "version": "5.2.15.RELEASE-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.2.15.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.2.15.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.15.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f6715c14-0090-5dfa-9829-790e65eeb3bd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.2.15.RELEASE-tuxcare.1 of org.springframework:spring-messaging. CVE-2018-1270 is NOT present in Spring Framework 5.2.15.RELEASE-tuxcare.3. The vulnerability (arbitrary code execution through unrestricted SpEL evaluation in STOMP subscription selectors) was fixed by upstream Spring Framework before version 5.2.15.RELEASE. The fix replaced StandardEvaluationContext with SimpleEvaluationContext, preventing malicious SpEL expressions from executing arbitrary code. The fix commit (e0de9126ed) by Rossen Stoyanchev was already present when TuxCare onboarded this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.15.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2045280e-5028-5030-bf33-29273a8d6508",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.2.15.RELEASE-tuxcare.1 of org.springframework:spring-messaging. CVE-2018-1275 is NOT present in Spring Framework 5.2.15.RELEASE-tuxcare.3. The vulnerability was fixed in upstream commit e0de9126ed by Rossen Stoyanchev (Pivotal) on March 21, 2018, which was already included in the 5.2.15.RELEASE that TuxCare onboarded. The fix replaces StandardEvaluationContext (which allows arbitrary method invocation and constructor calls leading to RCE) with SimpleEvaluationContext (restricted to read-only property access) in DefaultSubscriptionRegistry's STOMP message selector expression evaluation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.15.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e02d3e7f-dda4-5480-b1d0-0e31b6379af3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22971 affects version 5.2.15.RELEASE-tuxcare.1 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.15.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d9470184-e64c-5278-ab83-25a62704282b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.15.RELEASE-tuxcare.1 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.2.15.RELEASE-tuxcare.1"
    }
  ]
}