{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:e0259c6b-0c19-5898-9c83-4155f12d9caa",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3",
      "version": "5.3.32-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.32",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.32"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:04f82719-9bce-5a17-9245-43cde9bf89b4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-messaging. CVE-2018-1270 is NOT present in Spring Framework 5.3.32. The vulnerability involved remote code execution through malicious SpEL expressions in STOMP subscription selectors evaluated with StandardEvaluationContext. The upstream fix (commit e0de9126ed, March 21, 2018) replaced StandardEvaluationContext with SimpleEvaluationContext, which restricts evaluation to property access only and prevents arbitrary method calls and class loading. This fix was already present in the upstream Spring Framework 5.3.32 release when TuxCare onboarded it (first TuxCare commit 0632462efc, onboarding version 5.3.32). The target code at lines 70-72 and 230 of DefaultSubscriptionRegistry.java shows SimpleEvaluationContext is in use, confirming the fix is present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:6b176734-3442-524b-9d2c-4536d9b32c6b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-messaging. Spring Framework 5.3.32 is NOT vulnerable to CVE-2018-1275. The fix (switching DefaultSubscriptionRegistry from StandardEvaluationContext to SimpleEvaluationContext) was already present in the upstream release 5.3.32 that TuxCare onboarded. The vulnerable pattern (use of StandardEvaluationContext allowing arbitrary code execution via malicious STOMP selector expressions) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:1639281b-55b5-5849-8dba-6ca4506acc0f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 is not present in Spring Framework 5.3.32. The vulnerability (DoS via duplicate STOMP CONNECT frames) was fixed in upstream Spring Framework v5.3.20 (April 29, 2022). The fix adds validation to reject duplicate CONNECT frames on already-connected sessions in both SimpleBrokerMessageHandler and StompBrokerRelayMessageHandler. Since the target version 5.3.32 is after v5.3.20, it in...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:5831a2a7-a183-5166-b0e6-86fc2c02b98f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.32-tuxcare.3"
    }
  ]
}