{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:964b60c4-02c9-50b5-bd51-02c3fd901119",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.2.17.RELEASE-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.2.17.RELEASE-tuxcare.3",
      "version": "5.2.17.RELEASE-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.2.17.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.2.17.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.17.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:b2a647c4-66db-5fc2-b678-4696aa5ad219",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-messaging. CVE-2018-1270 affects Spring Framework versions with unsafe SpEL expression evaluation in STOMP message selectors. The target version 5.2.17.RELEASE already contains the upstream fix (commit e0de9126) that replaced StandardEvaluationContext with SimpleEvaluationContext, preventing remote code execution. The vulnerable code pattern is not present; it was fixed by Spring upstream in March 2018 and shipped in v5.0.5.RELEASE and all subsequent versions including v5.2.17.RELEASE. TuxCare onboarded this version with the fix already present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.17.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:b2caf4d8-5e3e-5af1-a94c-aa6f488ea52e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-messaging. CVE-2018-1275 is NOT present in Spring Framework 5.2.17.RELEASE. The vulnerability (arbitrary code execution via malicious SpEL expressions in STOMP subscription selectors using StandardEvaluationContext) was fixed by upstream Spring in March 2018 (commit e0de9126ed). The target uses SimpleEvaluationContext which restricts SpEL to property access only, preventing arbitrary method invocation. This fix was already present in the upstream 5.2.17.RELEASE that TuxCare onboarded, making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.17.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:478b756f-f464-5fb9-bb5c-e3ebe64431d4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.17.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:f3102d45-f67d-50a5-be04-9ba5e27822f2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.17.RELEASE-tuxcare.3 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.2.17.RELEASE-tuxcare.3"
    }
  ]
}