{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:42bb2afa-a441-599e-960f-28e3f42d92ef",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.0.12-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.0.12-tuxcare.6",
      "version": "6.0.12-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.0.12",
            "type": "library",
            "group": "org.springframework",
            "version": "6.0.12"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:2dc0fb47-246b-51f9-8ae0-640b497c5052",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-messaging. CVE-2018-1270 affects Spring Framework versions 5.0 < 5.0.5 and 4.3 < 4.3.16 due to unsafe SpEL expression evaluation using StandardEvaluationContext in STOMP message selectors. The target version (6.0.12-tuxcare.7) contains the upstream fix (commit e0de9126) which replaced StandardEvaluationContext with SimpleEvaluationContext, preventing arbitrary method invocation and RCE. The fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) from the Spring Framework team and shipped in the upstream release before TuxCare onboarded version 6.0.12. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:6ea67ee5-6c1a-513a-b8a9-3a8d78be2361",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework versions 5.0 < 5.0.5 and 4.3 < 4.3.16 due to unrestricted SpEL evaluation in STOMP message selectors. The target (version 6.0.12) is NOT AFFECTED because the upstream fix was already present when TuxCare onboarded this version. The vulnerable StandardEvaluationContext was replaced with SimpleEvaluationContext by upstream Spring Framework in commit e0de9126 (March 2018). This fix shipped in upstream releases 4.3.16 and 5.0.5, and was inherited by all subsequent versions including 6.0.12.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:dffd9252-78ad-568a-91d7-83abee32c3f9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-messaging. not_affected \u2014 Target version 6.0.12 is not affected by CVE-2022-22971. The vulnerability (DoS via duplicate STOMP CONNECT frames) was fixed in upstream Spring Framework commit dc2947c52df18d5e99cad03383f7d6ba13d031fd by Rossen Stoyanchev on April 29, 2022. This fix was already present in the upstream 6.0.12 release when TuxCare onboarded it (onboarding commit fb33a3173a), as confirmed by git ancestry checks....",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:d7e13e82-be7b-5530-ad91-af7725ae8b76",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.0.12-tuxcare.6"
    }
  ]
}