{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:bb2116c8-c710-56bc-acde-f7a95ce9a34b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.0.13-tuxcare.7",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.0.13-tuxcare.7",
      "version": "6.0.13-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.0.13",
            "type": "library",
            "group": "org.springframework",
            "version": "6.0.13"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.13-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:0afa4bae-656d-5295-8a2b-9d570b420a3f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.0.13-tuxcare.7 of org.springframework:spring-messaging. CVE-2018-1270 is NOT present in Spring Framework 6.0.13-tuxcare.7. The vulnerability, which allowed remote code execution through malicious SpEL expressions in STOMP subscriptions using StandardEvaluationContext, was fixed by upstream Spring Framework in March 2018 (commit e0de9126). The fix replaced StandardEvaluationContext with SimpleEvaluationContext to prevent unrestricted method invocation. This fix was included in Spring Framework releases 5.0.5 and 4.3.16 (April 2018) and is present in all subsequent releases including the target version 6.0.13. The vulnerable code pattern does not exist in the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.13-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:a40da6ac-9367-5ea6-bdb1-3533620ddb66",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.0.13-tuxcare.7 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16. The target version 6.0.13-tuxcare.7 is not affected because the upstream vendor fix (replacing StandardEvaluationContext with SimpleEvaluationContext for SpEL expression evaluation) was already present in the upstream Spring Framework 6.0.13 release when TuxCare onboarded it. The vulnerable pattern is completely absent from the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.13-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:74beaefa-39f9-5497-81df-9eb36db14f9d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.0.13-tuxcare.7 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 (STOMP over WebSocket DoS via duplicate CONNECT frames) is NOT present in Spring Framework 6.0.13-tuxcare.6. The fix was already included in the upstream Spring Framework 6.0.0 release (May 2022), over 4 years before TuxCare onboarded version 6.0.13 (August 2026). Both affected handlers (SimpleBrokerMessageHandler and StompBrokerRelayMessageHandler) contain the defense that check...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.13-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:dbdd9c81-11a8-5204-bc0e-873e07846711",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.13-tuxcare.7 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.0.13-tuxcare.7"
    }
  ]
}