{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:2989d999-ed3e-5f01-b7e8-b0d82f8e4578",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.21-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.21-tuxcare.6",
      "version": "5.3.21-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.21",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.21"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:e8204e87-5b32-5dc0-8228-f9fe3a1eb58f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.3.21-tuxcare.6 of org.springframework:spring-messaging. CVE-2018-1270 affects Spring Framework versions 5.0 < 5.0.5 and 4.3 < 4.3.16 due to remote code execution via SpEL injection in STOMP message subscription selectors. The vulnerability exists when DefaultSubscriptionRegistry uses StandardEvaluationContext, which allows full Java reflection and arbitrary code execution. The target repository (Spring Framework 5.3.21) is NOT AFFECTED because the upstream vendor fix (commit e0de9126ed by rstoyanchev@pivotal.io) was already present in the 5.3.21 release. The fix replaced StandardEvaluationContext with SimpleEvaluationContext, which restricts expression evaluation to property accessors only, preventing RCE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:61cdce40-4827-5da2-afbc-74ea36b2114c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.3.21-tuxcare.6 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16. The target is Spring Framework 5.3.21, which already contains the upstream security fix. The vulnerability involved using StandardEvaluationContext for evaluating STOMP selector expressions, which allowed arbitrary code execution via malicious SpEL expressions. The fix (commit e0de9126ed by rstoyanchev@pivotal.io on 2018-03-21) replaced StandardEvaluationContext with SimpleEvaluationContext, restricting evaluation to property access only. This fix was shipped in the upstream 5.3.21 release that TuxCare onboarded (first TuxCare commit 38ea6f53 on 2025-10-29), making the target not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:227a8227-30e8-5bee-8077-15ecf3a0904b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 5.3.21-tuxcare.6 of org.springframework:spring-messaging. not_affected \u2014 The target Spring Framework 5.3.21 is NOT AFFECTED by CVE-2022-22971. The upstream Spring Framework 5.3.21 release already contained the fix (commit dc2947c52d by upstream author rstoyanchev@vmware.com) before TuxCare onboarded this version. Both SimpleBrokerMessageHandler and StompBrokerRelayMessageHandler contain the defense that checks if a session already exists before processing CONNECT fr...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.21-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:7e979d6d-9503-5bb9-9e1e-acceee8f0baa",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.21-tuxcare.6 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.21-tuxcare.6"
    }
  ]
}