{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:dfbf8ba0-62d1-54d1-9a92-8f6a1749229f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15",
      "version": "5.3.31-tuxcare.15",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.31",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.31"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15"
        }
      ],
      "bom-ref": "urn:uuid:9be50fee-ee48-5c44-ad09-e1f794324edd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.3.31-tuxcare.15 of org.springframework:spring-messaging. CVE-2018-1270 is NOT present in Spring Framework 5.3.31. The vulnerability involved using StandardEvaluationContext (unrestricted SpEL) when evaluating subscription selector expressions, allowing remote code execution. The fix switched to SimpleEvaluationContext (restricted to safe property access). The target code contains the upstream fix (commit e0de9126ed, March 2018) which was already included in Spring Framework 5.0.5.RELEASE and therefore in the 5.3.31 baseline before TuxCare maintenance began.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15"
        }
      ],
      "bom-ref": "urn:uuid:961c7647-7190-546b-aca4-81c7bcfdd1d8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.3.31-tuxcare.15 of org.springframework:spring-messaging. Spring Framework 5.3.31-tuxcare.15 is NOT affected by CVE-2018-1275. The SpEL injection vulnerability was fixed by upstream Spring Framework in commit e0de9126ed (March 21, 2018) which replaced the dangerous StandardEvaluationContext with a restricted SimpleEvaluationContext for STOMP message selector evaluation. This fix shipped in the upstream release before TuxCare's involvement (first TuxCare commit: June 27, 2024). The target code contains the secured implementation that prevents arbitrary code execution through SpEL expressions.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15"
        }
      ],
      "bom-ref": "urn:uuid:c8053bc6-f32c-5ff1-bef4-81131d7e2f6f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 5.3.31-tuxcare.15 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 affects Spring Framework versions prior to 5.3.20. The target version is 5.3.31, which already contains the upstream fix (commit dc2947c52d by rstoyanchev@vmware.com) that shipped in v5.3.20. The fix adds duplicate CONNECT frame detection in both SimpleBrokerMessageHandler and StompBrokerRelayMessageHandler, preventing DoS attacks via repeated connection processing. The vulnerabl...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15"
        }
      ],
      "bom-ref": "urn:uuid:4df0e197-65b8-5841-8220-2c26d35166a6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.31-tuxcare.15"
    }
  ]
}