{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:fd6b6362-95d7-59a1-9875-62d918130869",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.6-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.6-tuxcare.4",
      "version": "5.3.6-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.6",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.6"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.6-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:d36b90e3-e648-54e9-a69d-4db866a9d834",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.3.6-tuxcare.4 of org.springframework:spring-messaging. The target Spring Framework version 5.3.6-tuxcare.2 is not affected by CVE-2018-1270. The vulnerability involved unsafe SpEL (Spring Expression Language) evaluation in STOMP message selector headers using StandardEvaluationContext, which allowed arbitrary code execution. The fix (commit e0de9126ed) replaced StandardEvaluationContext with SimpleEvaluationContext, restricting expression evaluation to only property access and blocking method invocation. This upstream fix was committed in March 2018 and first released in Spring Framework 5.0.5.RELEASE. The target version 5.3.6 (onboarded by TuxCare in September 2026) already contains this upstream fix. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.6-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:0c558699-07a3-5883-b989-033899a024bd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.3.6-tuxcare.4 of org.springframework:spring-messaging. The target Spring Framework 5.3.6 is NOT AFFECTED by CVE-2018-1275. The vulnerable code pattern (using StandardEvaluationContext with message as root object for SpEL expression evaluation) was removed by upstream commit e0de9126ed (rstoyanchev@pivotal.io, 2018-03-21), which replaced it with SimpleEvaluationContext that restricts SpEL to property access only. This fix was already present in the upstream Spring Framework 5.3.6 release when TuxCare onboarded it (2026-09-07). The target code at DefaultSubscriptionRegistry.java lines 70-72 uses the secure SimpleEvaluationContext.forPropertyAccessors() pattern, and no StandardEvaluationContext usage exists in the spring-messaging module.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.6-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:24ac2bf7-f7ad-53a2-9c26-b84a7648ae94",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22971 affects version 5.3.6-tuxcare.4 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.6-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:801e54b1-a244-55ac-9147-e6e5810b9401",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.6-tuxcare.4 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.6-tuxcare.4"
    }
  ]
}