{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:fb331774-f11a-54e0-87a3-2ed317555d82",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.13-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.13-tuxcare.1",
      "version": "5.3.13-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.13",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.13"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.13-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b55af55a-7515-5687-8692-13d80eac4eeb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.3.13-tuxcare.1 of org.springframework:spring-messaging. CVE-2018-1270 is NOT present in Spring Framework 5.3.13. The vulnerability (arbitrary code execution via SpEL selector expressions using StandardEvaluationContext) was fixed by upstream commit e0de9126 on March 21, 2018, which shipped in the upstream release before TuxCare onboarding. The target code uses SimpleEvaluationContext with static reuse and explicit message parameter passing, preventing malicious SpEL expressions from executing arbitrary code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.13-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ac7be75d-6ee0-5de2-beae-c2ed14593e32",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.3.13-tuxcare.1 of org.springframework:spring-messaging. CVE-2018-1275 is NOT present in Spring Framework 5.3.13. The vulnerability, which allowed remote code execution through malicious SpEL expressions in STOMP subscription selectors, was fixed in the upstream release. The target code uses SimpleEvaluationContext (restricted evaluation) instead of StandardEvaluationContext (unrestricted), preventing arbitrary method invocation. The fix commit e0de9126ed8cf25cf141d3e66420da94e350708a by upstream author Rossen Stoyanchev was already present in the 5.3.13 release before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.13-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8dd397ba-0c50-5ed7-961c-af3d9e0418bb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.3.13-tuxcare.1 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.13-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0ba96481-9a3b-5d89-8648-eaa267b5fcc2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.13-tuxcare.1 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.13-tuxcare.1"
    }
  ]
}