{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:da0592d3-d9f4-5e2e-bf0b-37059dbc70d4",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-messaging",
      "purl": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2",
      "version": "5.1.7.RELEASE-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-messaging",
            "purl": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "5.1.7.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:90062b1e-6df8-515d-8eab-591dc16be051",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4cc05aff-e2b6-5b42-b937-6d1a7dbc0cc2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ac2f9525-1328-586a-9e95-7aed33cd70ed",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:36377a3a-d1c4-5bdb-b1d9-6ff51b134030",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8517f9f3-182e-5064-9f5a-1e99ef91a135",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a7f052c6-ac57-5e4d-8af9-fd98bd783bf6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7a53c3d2-7e3f-5755-93fc-d20a9fdd3abe",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:44333b04-3c87-534a-a584-da23e06cf482",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11040 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d1704a51-b205-57c1-9cc7-8a31e2569041",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3063b827-2e58-5238-bc09-747245eef950",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1257 does not affect version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging. not_affected \u2014 The target Spring Framework 5.1.7.RELEASE is NOT affected by CVE-2018-1257. The vulnerability involves a regex denial of service attack via malicious selector headers in STOMP subscription messages. The upstream vendor (Spring/Pivotal) fixed this vulnerability in commit ff2228fdaf (April 2018) by adding a null-check guard that prevents parsing of selector expressions when selector support is di...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:30fa4734-cdae-51e9-8a5c-ddf1d8c1219b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2018-1270",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a4d6ee51-c82a-5c98-a808-535f122dec9b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1270 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:53938ee8-1e99-5a6f-9879-522b797adbbe",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1271 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f064585b-94c1-55be-8a1e-1c78c92f400c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1272 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2018-1275",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e1ec198e-18c6-5333-9d94-d86fb72bf970",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1275 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:55ae4132-fa13-56e4-864a-d8fe6e51fac3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2bd06ee3-2740-5991-a745-c77e5d679845",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:38554374-c102-5168-bcdd-68edee621993",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d0137349-5b40-5b07-a2a3-3c2f583f71af",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:05865453-4994-5a01-8433-6b6c627b6cf6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22970 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:67a221ef-df1c-53a8-8e65-fc33d5ae3487",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5ced8fca-e868-5e06-94fe-e751ac952e39",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ffe58a18-6a7e-5154-8bb5-f26454803737",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:02f9eb1f-11a5-56c0-aad5-b14cad35c809",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:97ac25f3-91fe-53cf-934e-764d3bdbc3d9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47888 does not affect version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging. CVE-2026-47888 is a memory leak in Spring Framework's RSocket support in spring-messaging, which was added in 5.2.0. Spring Framework 5.1.7.RELEASE contains no RSocket code, so it is not affected.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b8551381-448f-54eb-99ae-25387763abee",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.1.7.RELEASE-tuxcare.2 of org.springframework:spring-messaging."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE-tuxcare.2"
    }
  ]
}