{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:66cb8fcd-8ee8-5abe-874b-2d2ea04b27a0",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.20-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.20-tuxcare.3",
      "version": "5.3.20-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.20",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.20"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.20-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:7e300b6e-abd7-5093-97f5-523c4faf1d94",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.3.20-tuxcare.3 of org.springframework:spring-messaging. CVE-2018-1270 affects Spring Framework's STOMP over WebSocket implementation, where malicious STOMP selector expressions evaluated with StandardEvaluationContext could achieve remote code execution through SpEL injection. The target Spring Framework 5.3.20 is NOT AFFECTED because the upstream fix (commit e0de9126ed by Rossen Stoyanchev) was already present in the release before TuxCare onboarding. The target uses SimpleEvaluationContext which restricts SpEL evaluation to property access only, blocking method calls, constructor invocations, and bean references that enable RCE. The vulnerable pattern (StandardEvaluationContext for untrusted input) is not present in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.20-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:4a0e1eb5-c0ad-50c5-b0c2-614ed6372dab",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.3.20-tuxcare.3 of org.springframework:spring-messaging. CVE-2018-1275: Target version 5.3.20 is NOT AFFECTED. The vulnerability involves unsafe SpEL expression evaluation using StandardEvaluationContext in STOMP message selector processing, allowing remote code execution. The upstream Spring Framework fixed this in March 2018 (commit e0de9126ed) by replacing StandardEvaluationContext with SimpleEvaluationContext. This fix was included in the upstream v5.3.20 release (May 2022) before TuxCare onboarding. The target code uses SimpleEvaluationContext exclusively; no vulnerable StandardEvaluationContext pattern exists in the spring-messaging module.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.20-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:d9d07feb-e00e-5caf-98b8-8540f86fecb3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 5.3.20-tuxcare.3 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 does not affect Spring Framework 5.3.20 because the upstream fix was already included in the v5.3.20 release. The vulnerability allows authenticated users to cause DoS via duplicate STOMP CONNECT frames. Both affected message handlers (SimpleBrokerMessageHandler and StompBrokerRelayMessageHandler) contain the defensive check that rejects CONNECT frames when a session is already e...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.20-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:51181507-9c9c-5510-b1a9-5d51242aa5c1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.20-tuxcare.3 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.20-tuxcare.3"
    }
  ]
}