{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f1227997-954a-55dc-9829-6d6984f2abfc",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.3.9-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.3.9-tuxcare.3",
      "version": "5.3.9-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.3.9",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:748972c6-29c0-557e-afb9-3f79684fd7ab",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 5.3.9-tuxcare.3 of org.springframework:spring-messaging. CVE-2018-1270 affects Spring Framework versions using StandardEvaluationContext for STOMP subscription selector evaluation, allowing SpEL injection leading to RCE. The target Spring Framework 5.3.9 is NOT affected because the upstream vendor (Pivotal/Spring) already fixed this vulnerability in March 2018 by replacing StandardEvaluationContext with SimpleEvaluationContext (commit e0de9126ed). The fix was included in the upstream 5.3.9 release that TuxCare onboarded. No vulnerable code pattern exists in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:0193f3f9-f864-547c-91a8-fcb893541fe3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 5.3.9-tuxcare.3 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16. The target version 5.3.9 is not affected because the upstream fix (commit e0de9126ed by rstoyanchev@pivotal.io from March 2018) was already included in the upstream 5.3.9 release (July 2021) that TuxCare onboarded. The vulnerable pattern (using StandardEvaluationContext with message as root object for STOMP selector expression evaluation) is not present. The code uses SimpleEvaluationContext instead, which restricts SpEL capabilities to only property access, preventing arbitrary code execution through crafted STOMP messages.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:e6c59031-c5d4-54ed-84c6-0eac60666205",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.3.9-tuxcare.3 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.3.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:d6cd8269-044f-59d4-bd45-a5989afdb03c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.9-tuxcare.3 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.3.9-tuxcare.3"
    }
  ]
}