{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d44e118b-38be-5958-9f96-4afc634d3fe9",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.19-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.19-tuxcare.1",
      "version": "5.3.19-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.19",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.19"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.19-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:29efd3c5-5820-5fae-b3c2-3fd68846651f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring-messaging. The target (Spring Framework 5.3.19) is not affected by CVE-2018-1270. The vulnerability allowed remote code execution via malicious SpEL expressions in STOMP subscription selectors when StandardEvaluationContext was instantiated with messages as root objects, granting unrestricted reflective access. The fix (replacing StandardEvaluationContext with SimpleEvaluationContext and passing messages as parameters rather than root objects) shipped in upstream release v5.0.5.RELEASE (March 2018), authored by Rossen Stoyanchev from Pivotal/Spring. This upstream fix predates all TuxCare work on the repository. The target version 5.3.19 includes this fix, and no vulnerable code paths remain in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.19-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5257c327-3ac2-54fb-a216-202ce1f69195",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring-messaging. Target Spring Framework 5.3.19 is NOT affected by CVE-2018-1275. The vulnerability (RCE via StandardEvaluationContext in STOMP subscription selectors) was fixed upstream in March 2018 by commit e0de9126ed, which replaced StandardEvaluationContext with SimpleEvaluationContext. This fix shipped with upstream v5.3.19 (released April 2022), 4 years after the CVE was addressed. The CVE affects versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16; version 5.3.19 is much newer and contains the upstream fix. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.19-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:41282fb6-b383-5d73-a8b0-83b3f7569d7e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.19-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:24350111-bb97-56dd-ace2-d1859d37ad5b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.19-tuxcare.1"
    }
  ]
}