{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:db2b17d6-61c5-5485-a330-cd6852e00914",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.2.9.RELEASE-tuxcare.5",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.2.9.RELEASE-tuxcare.5",
      "version": "5.2.9.RELEASE-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.2.9.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.2.9.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.9.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:7b06945e-97eb-59c0-a891-5386b458d2a0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.2.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging. The target Spring Framework 5.2.9.RELEASE-tuxcare.2 is NOT AFFECTED by CVE-2018-1270. The vulnerability (SpEL injection via STOMP message selectors allowing RCE) has been fixed by upstream commit e0de9126ed authored by rstoyanchev@pivotal.io, which replaced the dangerous StandardEvaluationContext with restricted SimpleEvaluationContext. This fix was already present in the upstream 5.2.9.RELEASE when TuxCare onboarded it (verified via merge-base: fix is ancestor of first TuxCare commit 097b1afb26). The vulnerable code pattern is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.9.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:f7c68947-45d8-58bb-9524-444b2a8558a6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.2.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging. The target Spring Framework 5.2.9.RELEASE is NOT affected by CVE-2018-1275. The vulnerability involves SpEL injection through STOMP subscription selectors due to the use of StandardEvaluationContext with unrestricted reflection access. The upstream Spring Framework team fixed this in March 2018 (commit e0de9126ed) by replacing StandardEvaluationContext with SimpleEvaluationContext and using a static shared evaluation context. This fix was included in Spring Framework 5.0.10+ and all subsequent releases. The target version 5.2.9.RELEASE (released ~2020) already contained the fix when TuxCare onboarded it in September 2026. TuxCare did backport this CVE fix to older affected versions (4.2.9, 4.3.4, 4.3.5, 4.3.9) but not to 5.2.9 because it wasn't needed.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.9.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:5530acda-7b9f-5cbc-af63-cccb14884e40",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22971 affects version 5.2.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.2.9.RELEASE-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:1bf5c985-bbdf-5af6-a79e-3ce761883444",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.9.RELEASE-tuxcare.5 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.2.9.RELEASE-tuxcare.5"
    }
  ]
}