{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0f39bc4c-2118-5408-948e-1536c86abdef",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.1.18-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.1.18-tuxcare.1",
      "version": "6.1.18-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.1.18",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.18"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.18-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8165fc6b-24ab-5eff-be87-d0e893daf74f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.1.18-tuxcare.1 of org.springframework:spring-messaging. CVE-2018-1270 affects Spring Framework versions that use StandardEvaluationContext for evaluating SpEL expressions in STOMP message selectors, allowing remote code execution. The target (Spring Framework 6.1.18-tuxcare.2) is NOT AFFECTED because the upstream fix was already included in the release that TuxCare onboarded. The vulnerable StandardEvaluationContext was replaced with SimpleEvaluationContext (which restricts SpEL to property-access-only) in upstream commit e0de9126ed8cf25cf141d3e66420da94e350708a by Rossen Stoyanchev, shipped before TuxCare's first commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.18-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c4b5b10b-6114-5e30-bcf8-6dca3c03d720",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.1.18-tuxcare.1 of org.springframework:spring-messaging. Spring Framework 6.1.18-tuxcare.2 is not affected by CVE-2018-1275. The vulnerability involved using StandardEvaluationContext for SpEL expression evaluation in STOMP message selectors, which allowed arbitrary code execution through malicious selector expressions. The target uses SimpleEvaluationContext with restricted property access only, preventing the attack. The fix (commit e0de9126) was authored by Rossen Stoyanchev from Pivotal in March 2018 and was already present in the upstream Spring Framework 6.1.18 release that TuxCare onboarded. The vulnerable pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.18-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:08eb1d8e-2c1c-53a1-b873-c622d669ba3a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.1.18-tuxcare.1 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 6.1.18 is not affected by CVE-2022-22971. The vulnerability, which allowed authenticated users to cause denial of service by sending duplicate STOMP CONNECT frames, was fixed in the upstream Spring Framework release before version 6.1.18. The fix (commit dc2947c52df18d5e99cad03383f7d6ba13d031fd by rstoyanchev@vmware.com) adds validation to reject duplicate CONNECT frames for al...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.18-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7b857463-94ab-5af1-83c9-a328a17f12d6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.18-tuxcare.1 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.1.18-tuxcare.1"
    }
  ]
}