{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:e2115267-94e2-5459-96d2-f253a05c5289",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.2.13-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.2.13-tuxcare.4",
      "version": "6.2.13-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.2.13",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.13"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.13-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:fb0d6198-99a3-5dc8-92fb-c297331aa99c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.2.13-tuxcare.4 of org.springframework:spring-messaging. CVE-2018-1270 affects Spring Framework versions 4.3 prior to 4.3.16 and 5.0 prior to 5.0.5, involving remote code execution via malicious SpEL expressions in STOMP subscription selectors. The target (Spring Framework 6.2.13-tuxcare.4) is not affected because the vulnerability was fixed by upstream Spring Framework in March 2018 (commit e0de9126ed), well before version 6.2.13 was released. The target uses SimpleEvaluationContext (secure) instead of StandardEvaluationContext (vulnerable), and includes additional defense-in-depth with SpEL selector support disabled by default since Spring Framework 6.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.13-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:f6e821e7-b8c9-582b-be2a-622773f4b7d5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.2.13-tuxcare.4 of org.springframework:spring-messaging. CVE-2018-1275 is NOT present in Spring Framework 6.2.13-tuxcare.4. The vulnerability involved using StandardEvaluationContext for SpEL expression evaluation in STOMP message selectors, which allowed arbitrary code execution. The target uses SimpleEvaluationContext (a restricted evaluation context) instead, which prevents access to arbitrary Java types, reflection, and method invocation. This fix was introduced by upstream Spring Framework in commit e0de9126ed by Rossen Stoyanchev and was already present in the upstream 6.2.13 release when TuxCare onboarded it. The CVE affected versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16; version 6.2.13 is much newer and includes the fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.13-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:e5b1a12e-0eff-5bd6-8031-a51b8348fca2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.2.13-tuxcare.4 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 affects Spring Framework versions prior to 5.3.20+ and 5.2.22+ where STOMP over WebSocket endpoints are vulnerable to DoS attacks via duplicate CONNECT frames. The target (Spring Framework 6.2.13) contains the upstream fix from commit dc2947c52d by rstoyanchev@vmware.com, which was shipped in the upstream release. Both SimpleBrokerMessageHandler.java and StompBrokerRelayMessageHa...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.13-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:d0286c88-7ad9-542c-bbdc-67733367ee15",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.2.13-tuxcare.4 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.2.13-tuxcare.4"
    }
  ]
}