{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d1f32cfc-875a-5c61-a159-f7f7c24d582d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.1.21-tuxcare.16",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.1.21-tuxcare.16",
      "version": "6.1.21-tuxcare.16",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.1.21",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.21"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.21-tuxcare.16"
        }
      ],
      "bom-ref": "urn:uuid:fa68c815-0bdc-5b03-bc17-7841dfda5906",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.1.21-tuxcare.16 of org.springframework:spring-messaging. The target repository (Spring Framework 6.1.21-tuxcare.16) is NOT AFFECTED by CVE-2018-1270. The vulnerable code pattern (using StandardEvaluationContext with user-controlled message as root object for SpEL expression evaluation) is not present. The fix was authored by upstream Spring Framework developer Rossen Stoyanchev (rstoyanchev@pivotal.io) on March 21, 2018, and was included in Spring Framework v5.0.5.RELEASE and v4.3.16.RELEASE - matching the CVE's fixed version ranges exactly. This upstream fix was already present in the Spring Framework release that TuxCare onboarded on October 6, 2025. The target code uses SimpleEvaluationContext with restricted property-only access, which prevents arbitrary code execution through malicious SpEL expressions in STOMP subscription selectors.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.21-tuxcare.16"
        }
      ],
      "bom-ref": "urn:uuid:764bd1ee-c42a-50d4-82a6-2c5102fadbca",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.1.21-tuxcare.16 of org.springframework:spring-messaging. CVE-2018-1275 is NOT present in Spring Framework 6.1.21-tuxcare.16. The vulnerability involved remote code execution through malicious SpEL expressions in STOMP selector headers, exploiting StandardEvaluationContext. The target uses SimpleEvaluationContext (line 76), which restricts evaluation to property access only and prevents arbitrary code execution. The fix was authored by upstream Spring developer Rossen Stoyanchev (rstoyanchev@pivotal.io) and was already present in the upstream release before TuxCare's first commit (d48bec5394). Additionally, SpEL selector support is disabled by default (selectorHeaderName=null, line 84).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.21-tuxcare.16"
        }
      ],
      "bom-ref": "urn:uuid:a0199cff-334f-5e6e-992c-57b7876a2e69",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.1.21-tuxcare.16 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 is not present in Spring Framework 6.1.21-tuxcare.16. The vulnerability was fixed in upstream version 5.3.20 (April 2022), and the fix was already included in the upstream v6.1.21 release that TuxCare onboarded. The target version contains the complete mitigation that prevents duplicate STOMP CONNECT frames from causing denial of service.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.21-tuxcare.16"
        }
      ],
      "bom-ref": "urn:uuid:b31dd07f-08fa-5029-af50-2585dc90a147",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.21-tuxcare.16 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.1.21-tuxcare.16"
    }
  ]
}