{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:701b9f0a-ede5-5910-a6cd-c113fd27daba",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.2.12-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.2.12-tuxcare.2",
      "version": "6.2.12-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.2.12",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.12"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.12-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d16a3be6-e320-5bfd-ae03-3e0af36deea9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-messaging. CVE-2018-1270 is NOT present in Spring Framework 6.2.12. The vulnerability involved using StandardEvaluationContext for SpEL expression evaluation in STOMP message selectors, which allowed arbitrary code execution. The target uses SimpleEvaluationContext instead, which restricts evaluation to property access only and prevents code execution. The fix was authored by upstream Spring Framework developer Rossen Stoyanchev (rstoyanchev@pivotal.io) in commit e0de9126ed8cf25cf141d3e66420da94e350708a and was already present in the upstream release that TuxCare onboarded for version 6.2.12.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.12-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3f334129-c32c-5184-ab83-9de926645e14",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16 through unrestricted SpEL expression evaluation in STOMP message selectors using StandardEvaluationContext. The target version 6.2.12 contains the complete upstream fix (commit e0de9126ed from March 2018) which replaces StandardEvaluationContext with SimpleEvaluationContext and restricts property access. The vulnerable code pattern is not present in this version - the fix was shipped in the upstream Spring Framework 5.0.5 release, years before version 6.2.12. Additionally, as of Spring Framework 6.1, the SpEL selector feature is disabled by default, providing defense-in-depth.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.12-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7e69cbee-52b9-57a3-8b90-b4c8c75d3e15",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.2.12-tuxcare.2 of org.springframework:spring-messaging. not_affected \u2014 The target repository Spring Framework 6.2.12 is not affected by CVE-2022-22971. The vulnerability (DoS via duplicate STOMP CONNECT frames) has been fixed by upstream commit dc2947c52d authored by rstoyanchev@vmware.com. This fix was already present in the upstream release that TuxCare onboarded, as confirmed by merge-base analysis showing the fix commit is an ancestor of the first TuxCare comm...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.12-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c2b6d8d2-fb44-5919-b802-6880523dad6b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.2.12-tuxcare.2 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.2.12-tuxcare.2"
    }
  ]
}