{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:5e69809d-8489-51bc-9bdf-0996fa031cd0",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.3",
      "version": "5.2.8.RELEASE-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.2.8.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:20362214-a080-547c-a154-776848b7c4a2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.2.8.RELEASE-tuxcare.3 of org.springframework:spring-messaging. CVE-2018-1270 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16. The target version 5.2.8.RELEASE (July 2020) already contains the upstream security fix from v5.0.5.RELEASE (April 2018). The vulnerable StandardEvaluationContext has been replaced with sandboxed SimpleEvaluationContext, preventing SpEL injection attacks via STOMP subscription selectors.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:48edefdf-60ca-5c20-aab3-95f1d8c7d1eb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.2.8.RELEASE-tuxcare.3 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16 due to unrestricted SpEL expression evaluation in STOMP message selectors. The target version 5.2.8.RELEASE already contains the upstream fix (commit e0de9126ed from March 2018) that replaced StandardEvaluationContext with SimpleEvaluationContext, restricting expression evaluation to property access only. The fix was shipped in the upstream 5.2.8.RELEASE that TuxCare onboarded, so the vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:566ae91a-1054-5816-8b89-120111bda16b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22971 affects version 5.2.8.RELEASE-tuxcare.3 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:93657fcc-ece0-5700-914f-4f6a69120d9a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.8.RELEASE-tuxcare.3 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.3"
    }
  ]
}