{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3d6ce8b4-fba0-5cf0-8f66-766a2087a242",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.1.7-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.1.7-tuxcare.6",
      "version": "6.1.7-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.1.7",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.7-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:377912b1-103b-5754-b003-2901ee889231",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.1.7-tuxcare.6 of org.springframework:spring-messaging. CVE-2018-1270 affects Spring Framework versions using StandardEvaluationContext for evaluating STOMP subscription selector expressions, allowing remote code execution via malicious SpEL expressions. The target (spring-framework 6.1.7-tuxcare.9) is NOT AFFECTED because the vulnerable code pattern is not present. The upstream fix commit e0de9126ed (March 21, 2018) by Rossen Stoyanchev replaced StandardEvaluationContext with SimpleEvaluationContext, which restricts SpEL evaluation to safe property access only, blocking object instantiation, method invocation, and arbitrary code execution. This fix was already present in the upstream Spring Framework 6.1.7 release that TuxCare onboarded (commit 951dff3c13). The current code uses SimpleEvaluationContext throughout, and no StandardEvaluationContext usage exists in the spring-messaging module. Additionally, the selector feature is disabled by default in this version for defense-in-depth.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.7-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:2b4a1e2c-f09a-5eaf-b3ef-2905e62741fd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.1.7-tuxcare.6 of org.springframework:spring-messaging. Spring Framework 6.1.7-tuxcare.9 is NOT affected by CVE-2018-1275. The vulnerability (SpEL injection via unsafe StandardEvaluationContext in STOMP subscription selectors) was fixed in upstream commit e0de9126ed by replacing StandardEvaluationContext with SimpleEvaluationContext. This fix shipped in the upstream Spring Framework 6.1.7 release before TuxCare onboarded it (first TuxCare commit: 951dff3c13). The vulnerable code pattern is not present in the target. Additionally, Spring 6.1+ disables SpEL selector support by default as defense-in-depth.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.7-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:1245d35f-6932-5292-a4ac-630a86260195",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.1.7-tuxcare.6 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 6.1.7 is not affected by CVE-2022-22971. The fix for this STOMP WebSocket DoS vulnerability was introduced in upstream version 5.3.20 (April 2022) and is present in all Spring 6.x releases including 6.1.7. The vulnerable pattern (processing duplicate CONNECT frames without checking if session already exists) is not present in the target code.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.1.7-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:8fc990b0-3985-57a1-8e92-9ed1ad9b1c8e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.7-tuxcare.6 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.1.7-tuxcare.6"
    }
  ]
}