{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7f2ecc17-1385-53ec-8730-36878766b312",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.18-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.18-tuxcare.3",
      "version": "5.3.18-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.18",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.18"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.18-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:6f1ad5d5-fd74-558c-b3f6-c853c906c243",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.3.18-tuxcare.3 of org.springframework:spring-messaging. Target Spring Framework 5.3.18-tuxcare.3 is NOT AFFECTED by CVE-2018-1270. The vulnerability pattern (StandardEvaluationContext with message root object allowing arbitrary method invocation via SpEL) is not present. The target uses SimpleEvaluationContext with restricted property accessors, matching the upstream fix commit e0de9126ed by rstoyanchev@pivotal.io. This fix was already in Spring Framework 5.3.18 upstream release before TuxCare onboarding (first TuxCare commit 034d153bb57507566fd9bcc9db2b1c51f88242b0). The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.18-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:acaa5566-3101-50b2-9053-24d8bfb95ec3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.3.18-tuxcare.3 of org.springframework:spring-messaging. Spring Framework 5.3.18 is not affected by CVE-2018-1275. The vulnerability was fixed in upstream version 5.0.5 (March 2018) by replacing StandardEvaluationContext with SimpleEvaluationContext in DefaultSubscriptionRegistry. Version 5.3.18 already contains this fix as shipped by the upstream Spring Framework team, preventing SpEL expression injection in STOMP message selectors.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.18-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:89c066c3-b352-5054-ab09-cc3a0b5b20cb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.3.18-tuxcare.3 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.18-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:1fc8ab35-10d5-56b2-a5f1-042f72df8ec5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.18-tuxcare.3 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.18-tuxcare.3"
    }
  ]
}