{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:fd432c31-753e-570f-9474-d4384a31e5fa",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.23-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.23-tuxcare.4",
      "version": "5.3.23-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.23",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.23"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.23-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:f50dfb8c-b88c-505c-ae28-cc6eebb42dae",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.3.23-tuxcare.4 of org.springframework:spring-messaging. The target Spring Framework 5.3.23-tuxcare.4 is NOT affected by CVE-2018-1270. The vulnerability (arbitrary code execution via unsafe SpEL expression evaluation with StandardEvaluationContext) is not present in this version. The fix was already included in the upstream Spring Framework 5.3.23 release (October 2022), years after the vulnerability was originally patched in versions 5.0.5 and 4.3.16 (April 2018). The target uses SimpleEvaluationContext with property-access-only restrictions, preventing the remote code execution attack vector. Fix commit e0de9126ed by upstream Spring developer rstoyanchev@pivotal.io was already present in the upstream release before TuxCare onboarded version 5.3.23.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.23-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:06097494-b273-56d5-96d4-c461272d8efd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.3.23-tuxcare.4 of org.springframework:spring-messaging. CVE-2018-1275 is not present in Spring Framework 5.3.23. The vulnerability involved unrestricted SpEL evaluation using StandardEvaluationContext in STOMP message selectors, allowing remote code execution. The upstream fix (commit e0de9126ed by Rossen Stoyanchev, March 2018) replaced StandardEvaluationContext with SimpleEvaluationContext, which blocks type references, constructors, and bean access. This fix was included in upstream release v5.0.5.RELEASE and is present in the target version 5.3.23.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.23-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ca95abc2-c14c-5846-915e-74883d74043b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 5.3.23-tuxcare.4 of org.springframework:spring-messaging. not_affected \u2014 The target Spring Framework 5.3.23 is not affected by CVE-2022-22971. The vulnerability was fixed in upstream version 5.3.20, and the fix is present in the target at commit dc2947c52df authored by rstoyanchev@vmware.com. The fix adds validation to reject duplicate STOMP CONNECT frames for already-connected sessions, preventing the denial-of-service attack through repeated connection establishment.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.23-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:dfc3ee97-5447-5065-b872-e743f21af025",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.23-tuxcare.4 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.23-tuxcare.4"
    }
  ]
}