{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f5f691da-c989-5717-9a0b-8d14440e1dec",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@6.2.7-tuxcare.3",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@6.2.7-tuxcare.3",
      "version": "6.2.7-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@6.2.7",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.7-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:4383b571-10a3-5d42-be7d-e4e8f7e38d05",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1270 does not affect version 6.2.7-tuxcare.3 of org.springframework:spring-messaging. CVE-2018-1270 is NOT present in Spring Framework 6.2.7-tuxcare.3. The vulnerability involved SpEL (Spring Expression Language) injection in STOMP over WebSocket selector expressions, where StandardEvaluationContext allowed arbitrary code execution. The target code uses SimpleEvaluationContext (lines 38, 75-76) which restricts evaluation to property access only, preventing method invocation and RCE. The fix (commit e0de9126ed by upstream developer Rossen Stoyanchev) was already present in upstream release 6.2.7 when TuxCare onboarded it. Additionally, the selector feature is disabled by default in Spring Framework 6.1+ (line 60), providing defense-in-depth.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.0.0.RELEASE, < 5.0.5.RELEASE; < 4.3.16.RELEASE), NVD (< 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.15), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.7-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:863edb93-f235-52a5-8b67-3073756a8da9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1275 does not affect version 6.2.7-tuxcare.3 of org.springframework:spring-messaging. CVE-2018-1275 is not present in Spring Framework 6.2.7-tuxcare.3. The vulnerability required StandardEvaluationContext which allows arbitrary code execution through SpEL expressions. The target uses SimpleEvaluationContext (restricted, safe evaluation) and the fix was shipped in the upstream release. Commit e0de9126ed by Rossen Stoyanchev (rstoyanchev@pivotal.io) on 2018-03-21 replaced StandardEvaluationContext with SimpleEvaluationContext and was present before TuxCare onboarded version 6.2.7. Additionally, SpEL selector support is disabled by default in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE), NVD (>= 4.3.0, < 4.3.16; >= 5.0.0, < 5.0.5), cve.org (< 5.0.5; < 4.3.16), Snyk (< 4.3.16.RELEASE; >= 5.0.0.RELEASE, < 5.0.5.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.7-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:052f6206-913e-586e-83f6-47f447983a42",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-22971 does not affect version 6.2.7-tuxcare.3 of org.springframework:spring-messaging. not_affected \u2014 Target Spring Framework 6.2.7 is not affected by CVE-2022-22971. The vulnerability (DoS via duplicate STOMP CONNECT frames) was fixed in upstream Spring Framework and shipped in version 6.2.7 before TuxCare onboarded it. Both affected message handlers (SimpleBrokerMessageHandler and StompBrokerRelayMessageHandler) contain the defensive checks that reject duplicate CONNECT frames by verifying se...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@6.2.7-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:972d89f6-4c82-5aae-b6e9-1e3fdcf0ec44",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.2.7-tuxcare.3 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@6.2.7-tuxcare.3"
    }
  ]
}