{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1bffb571-119b-5b43-8ce5-fdc43523cf05",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.7-tuxcare.11",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.7-tuxcare.11",
      "version": "5.3.7-tuxcare.11",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.7",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.7-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:0089a8fa-9852-5b09-ab2f-64b89b81a0ab",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.3.7-tuxcare.11 of org.springframework:spring-messaging. CVE-2018-1270: Spring Framework STOMP WebSocket SpEL injection vulnerability is NOT present in target version 5.3.7. The vulnerable code pattern (using StandardEvaluationContext for SpEL evaluation, which allows arbitrary code execution) was replaced with SimpleEvaluationContext (which restricts evaluation to safe property access only) by upstream Spring Framework commit e0de9126ed in March 2018. This fix was already included in the Spring Framework 5.3.7 release that TuxCare onboarded, confirmed by verifying the fix commit is an ancestor of the first TuxCare commit (48017278bc \"Initial Tuxcare setup for spring 5.3.7\"). The target code at HEAD uses SimpleEvaluationContext throughout DefaultSubscriptionRegistry.java (line 38 import, lines 71-72 static context, line 230 evaluation call), providing complete protection against the CVE-2018-1270 attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.7-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:7c5a04f6-0763-53fa-8707-3a5090a1df8f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.3.7-tuxcare.11 of org.springframework:spring-messaging. Spring Framework 5.3.7 is NOT AFFECTED by CVE-2018-1275. The vulnerability involves SpEL injection in STOMP selector expressions leading to RCE via StandardEvaluationContext. The upstream Spring Framework fix (commit e0de9126ed by rstoyanchev@pivotal.io) replaced StandardEvaluationContext with SimpleEvaluationContext, which restricts SpEL evaluation to property-access only, preventing method invocation. This fix was already present in the upstream 5.3.7 release that TuxCare onboarded. The vulnerable code pattern (StandardEvaluationContext) is not present in the target; the file uses the secure SimpleEvaluationContext implementation throughout.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.7-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:c145b8fa-8513-5c3a-b64d-64314830e4ae",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.3.7-tuxcare.11 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.7-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:826e2332-33ef-57eb-ad6d-33b868f26305",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.7-tuxcare.11 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.7-tuxcare.11"
    }
  ]
}