{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8a0ddc4d-37b3-5412-82c9-138542195bcb",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.2.25.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.2.25.RELEASE-tuxcare.1",
      "version": "5.2.25.RELEASE-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.2.25.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.2.25.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.25.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:55cdc7c2-6b2a-53c6-a4f0-6d9e02eabda2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.2.25.RELEASE-tuxcare.1 of org.springframework:spring-messaging. CVE-2018-1270 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16. The vulnerability allows remote code execution through malicious STOMP messages containing SpEL expressions evaluated with StandardEvaluationContext. The target version 5.2.25.RELEASE already contains the upstream fix (commit e0de9126ed) from Spring Framework 5.0.5.RELEASE (March 2018), which replaces StandardEvaluationContext with SimpleEvaluationContext to prevent reflection-based code execution. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.25.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9207f4b0-88ba-5d72-9da4-c6cd59f04f0a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.2.25.RELEASE-tuxcare.1 of org.springframework:spring-messaging. CVE-2018-1275 is NOT present in Spring Framework 5.2.25.RELEASE. The vulnerability required StandardEvaluationContext which allows arbitrary method invocation through SpEL expressions in STOMP message selectors. The fix (commit e0de9126ed by Rossen Stoyanchev) replaced StandardEvaluationContext with SimpleEvaluationContext, restricting SpEL to property access only. This fix was already present in the upstream Spring Framework 5.2.25.RELEASE before TuxCare onboarded it (commit bc2c13ac). The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.25.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4bc7714e-d1ff-5e81-a0e3-598ab93ddb93",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 5.2.25.RELEASE-tuxcare.1 of org.springframework:spring-messaging. not_affected \u2014 The target Spring Framework 5.2.25.RELEASE is NOT vulnerable to CVE-2022-22971. The vulnerability (DoS via duplicate STOMP CONNECT frames) was fixed in upstream commit 159a99bbaf (April 29, 2022) by rstoyanchev@vmware.com. This fix was included in upstream v5.2.22.RELEASE (May 11, 2022), and therefore was already present when v5.2.25.RELEASE (July 13, 2023) was released. TuxCare onboarded the a...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.25.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3bb67a5f-3d64-5828-8218-a5bdb9b7f7d0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.25.RELEASE-tuxcare.1 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.2.25.RELEASE-tuxcare.1"
    }
  ]
}