{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:284ba0cf-b784-5324-8a2f-70ed900b91da",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.1.13-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.1.13-tuxcare.3",
      "version": "6.1.13-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.1.13",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.13"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.13-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:82d05f5e-397b-5afb-a7fb-3d26e504ed40",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.1.13-tuxcare.3 of org.springframework:spring-messaging. Spring Framework 6.1.13 is NOT affected by CVE-2018-1270. The vulnerability (RCE through StandardEvaluationContext in STOMP selector expressions) was fixed in upstream Spring Framework 5.0.5/4.3.16 (March-April 2018) by replacing StandardEvaluationContext with sandboxed SimpleEvaluationContext. This fix was already present in Spring Framework 6.1.13 when released upstream in 2024, long before TuxCare onboarded the version in August 2025. Additionally, Spring Framework 6.1+ disables selector support by default, providing defense-in-depth.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.13-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:fd8bd843-eea1-5633-bb70-62205fb66654",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.1.13-tuxcare.3 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16, where StandardEvaluationContext allowed arbitrary method execution through SpEL expressions in STOMP message selectors. The target version 6.1.13 is NOT affected - the vulnerable pattern (StandardEvaluationContext) is not present. The fix (SimpleEvaluationContext) was introduced by upstream Spring Framework in March 2018 (commit e0de9126) by Rossen Stoyanchev and was already included in the upstream release when TuxCare onboarded version 6.1.13. TuxCare backported this CVE only to affected 4.x versions (4.2.9, 4.3.4, 4.3.5, 4.3.9) where the upstream fix was not present; no backport to 6.x was needed as the fix was already upstream.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.13-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:562e4a70-6795-53b0-a4d8-022db330ebfa",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.1.13-tuxcare.3 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 6.1.13 is NOT affected by CVE-2022-22971. The vulnerability was fixed in the upstream Spring Framework project in April 2022 (commit dc2947c52d by rstoyanchev@vmware.com) and the fix was included in the upstream 6.1.13 release. Both affected files (SimpleBrokerMessageHandler.java and StompBrokerRelayMessageHandler.java) contain the fix that prevents duplicate STOMP CONNECT fram...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.13-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:bc874be9-8133-5097-b26e-6d7f0965736e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.13-tuxcare.3 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.1.13-tuxcare.3"
    }
  ]
}