{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:792925e3-611b-5f85-89d9-fdc804cb8b83",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.2.5-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.2.5-tuxcare.6",
      "version": "6.2.5-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.2.5",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.5-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:95acff0e-1d0e-5ddd-8570-7528bcfa8808",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.2.5-tuxcare.6 of org.springframework:spring-messaging. CVE-2018-1270: Target is NOT AFFECTED. The vulnerable code pattern (using StandardEvaluationContext with message as root object for SpEL expression evaluation) is not present in Spring Framework 6.2.5. The upstream vendor (Pivotal/VMware) fixed this RCE vulnerability in commit e0de9126 (March 2018) by replacing StandardEvaluationContext with SimpleEvaluationContext and passing the message as a typed parameter instead of a root object. This fix was already included in the upstream 6.2.5 release before TuxCare onboarded the version. Additionally, Spring Framework 6.1+ includes defense-in-depth by disabling SpEL selector support by default (commit 5bc80fc094).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.5-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:c617baa8-795e-581c-a311-57c3a6da1bdc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.2.5-tuxcare.6 of org.springframework:spring-messaging. Spring Framework 6.2.5 is not affected by CVE-2018-1275. The vulnerability involved unsafe SpEL expression evaluation using StandardEvaluationContext with message as root object in DefaultSubscriptionRegistry, enabling remote code execution via crafted subscription selector expressions. The fix (commit e0de9126ed) replaced StandardEvaluationContext with SimpleEvaluationContext and removed message as root object, restricting expression capabilities. This fix was authored by upstream Spring Framework (rstoyanchev@pivotal.io) and already present in release 6.2.5 when TuxCare onboarded it. The vulnerable code pattern does not exist in the target. Additionally, SpEL selector support is disabled by default in Spring Framework 6.1+.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.5-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:1984952a-c5a7-5309-9120-bf7e29025098",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.2.5-tuxcare.6 of org.springframework:spring-messaging. not_affected \u2014 Target Spring Framework version 6.2.5 is not affected by CVE-2022-22971. The vulnerability (DoS via duplicate STOMP CONNECT frames) was fixed in upstream commit dc2947c52d by VMware engineer rstoyanchev@vmware.com in April 2022. This fix was already present in the upstream Spring Framework 6.2.5 release, which TuxCare onboarded via commit a47acaad. Both vulnerable message handlers (SimpleBroker...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.5-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:aa42d24b-862f-582f-b46b-3bf0d2fabe6d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.2.5-tuxcare.6 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.2.5-tuxcare.6"
    }
  ]
}