{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:95119f43-58db-51da-a0a8-5a20e6ecafbc",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.2.19-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.2.19-tuxcare.2",
      "version": "6.2.19-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.2.19",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.19"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.19-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e3557d39-058b-534e-aa58-69b15d8ea6ab",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-messaging. CVE-2018-1270 is NOT present in Spring Framework 6.2.19. The vulnerability involved unsafe SpEL expression evaluation using StandardEvaluationContext in STOMP message selectors, allowing remote code execution. The upstream fix (commit e0de9126ed from March 2018) replaced StandardEvaluationContext with SimpleEvaluationContext, which restricts expression evaluation to safe property access only. This fix was already present in upstream Spring Framework 6.2.19 when TuxCare onboarded the version. Additionally, as of Spring Framework 6.1, the SpEL selector feature is disabled by default, providing defense-in-depth.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.19-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:04642a92-8b0d-54c2-bfa7-9567ca244a99",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-messaging. CVE-2018-1275 affects Spring Framework versions 5.0 prior to 5.0.5 and 4.3 prior to 4.3.16. The target version 6.2.19 is significantly newer and already contains the upstream fix. The vulnerable code pattern (using StandardEvaluationContext for SpEL expression evaluation) is not present; the target uses SimpleEvaluationContext, which restricts expression evaluation to prevent arbitrary code execution. The fix was authored by upstream Spring developer Rossen Stoyanchev in March 2018 and shipped with the upstream release before TuxCare onboarded version 6.2.19.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.19-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d23f0e4a-d644-53c9-af00-5deb0e39a882",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.2.19-tuxcare.2 of org.springframework:spring-messaging. not_affected \u2014 CVE-2022-22971 is not present in Spring Framework 6.2.19. The vulnerability (DoS via duplicate STOMP CONNECT frames) was fixed by upstream commit dc2947c52d authored by rstoyanchev@vmware.com, which shipped in Spring Framework 5.3.20+ (April 2022). The target version 6.2.19 was onboarded by TuxCare with the fix already present in the upstream release. Both SimpleBrokerMessageHandler.java and St...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.19-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9bae4d86-c948-5e2e-a5f1-912446df4a31",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.2.19-tuxcare.2 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.2.19-tuxcare.2"
    }
  ]
}