{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:af2340f9-3bfb-5e84-8913-fb6aa71517df",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.13",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.13",
      "version": "5.3.30-tuxcare.13",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.30",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.30"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:ce9750eb-2887-5b3b-8ee4-504cb5338caa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.3.30-tuxcare.13 of org.springframework:spring-messaging. CVE-2018-1270 is NOT present in Spring Framework 5.3.30-tuxcare.13. The vulnerability involved SpEL injection through STOMP message selector headers evaluated using StandardEvaluationContext (which allows arbitrary method invocation leading to RCE). The fix (commit e0de9126ed) replaced StandardEvaluationContext with SimpleEvaluationContext (restricting evaluation to safe property access only) and changed how messages are passed to the evaluator. This fix was authored by upstream Spring Framework team (Rossen Stoyanchev at Pivotal) on 2018-03-21 and was already present in Spring Framework v5.3.30, which TuxCare onboarded for ELS. The target inherited the fix from the upstream release. Analysis confirmed: DefaultSubscriptionRegistry.java imports SimpleEvaluationContext (line 38), uses static SimpleEvaluationContext instance (lines 71-72), and evaluates expressions safely (line 230). No instances of StandardEvaluationContext exist in spring-messaging module. Verdict: not_affected because the vulnerable code pattern is not present\u2014it was fixed in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:c9b89480-cbbc-5ca3-a0a2-13e154dac529",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.3.30-tuxcare.13 of org.springframework:spring-messaging. The target Spring Framework 5.3.30-tuxcare.13 is NOT vulnerable to CVE-2018-1275. The vulnerability (unrestricted SpEL expression evaluation via StandardEvaluationContext allowing remote code execution through STOMP message selectors) was fixed by upstream Spring Framework in March 2018 (commit e0de9126ed). The fix replaced StandardEvaluationContext with SimpleEvaluationContext, restricting SpEL to property access only and preventing method invocation/reflection. This fix was already present in the Spring 5.3.x release line that TuxCare onboarded in October 2025, over 7 years after the upstream fix. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:5aabdcad-893b-5264-9be2-4806fea29014",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 5.3.30-tuxcare.13 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 affects Spring Framework versions prior to 5.3.20+. The target version is 5.3.30, which already contains the upstream fix (commit dc2947c52d by rstoyanchev@vmware.com) that shipped with the v5.3.30 release. The fix prevents duplicate STOMP CONNECT frames from re-initializing sessions by checking if a sessionId already exists before processing CONNECT commands. Since the fix was p...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:e74c536c-de02-5547-abfb-c5f57be59cac",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.30-tuxcare.13 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.30-tuxcare.13"
    }
  ]
}