{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:34cbef44-a3d0-532a-b6c9-04e472d053e5",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.0.14-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.0.14-tuxcare.4",
      "version": "6.0.14-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.0.14",
            "type": "library",
            "group": "org.springframework",
            "version": "6.0.14"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.14-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:1c989847-cfa3-5dbf-af7c-55d499d3207c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.0.14-tuxcare.4 of org.springframework:spring-messaging. CVE-2018-1270 is NOT present in Spring Framework 6.0.14. The vulnerability involved unrestricted SpEL expression evaluation via StandardEvaluationContext in DefaultSubscriptionRegistry, enabling remote code execution through crafted STOMP messages. The target version uses SimpleEvaluationContext (lines 38, 72-74, 234), which blocks method invocation and constructor calls, preventing the attack path. The fix was authored by upstream Spring Framework (rstoyanchev@pivotal.io) in commit e0de9126ed and was already present in the upstream 6.0.14 release before TuxCare onboarded it (first TuxCare commit: 3cd3eb5397).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.14-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:4f97c258-28c6-5dbd-b6ad-7935fb4bfc3b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.0.14-tuxcare.4 of org.springframework:spring-messaging. Spring Framework 6.0.14 is not affected by CVE-2018-1275. The vulnerability, which allowed remote code execution via SpEL injection in STOMP message selectors using StandardEvaluationContext, was fixed in upstream Spring Framework 4.3.16 and 5.0.5 (March 2018). Version 6.0.14 was released years after this fix and contains the secure SimpleEvaluationContext implementation. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.14-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:2174593b-8baf-5110-955d-09cda8e0faab",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.0.14-tuxcare.4 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 affects Spring Framework STOMP over WebSocket endpoints where authenticated users could cause denial of service by sending duplicate CONNECT frames. The vulnerability is NOT PRESENT in the target (Spring Framework 6.0.14) because the upstream fix (commit dc2947c52d) was already included in the 6.0.14 release before TuxCare onboarded it. Both SimpleBrokerMessageHandler.java and St...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.0.14-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:f81c005b-4a59-5fce-9a27-fde48df4a8cf",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.14-tuxcare.4 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.0.14-tuxcare.4"
    }
  ]
}