{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f319f25d-bf94-56ce-ac88-2266d8e7e5ea", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1", "version": "5.1.18.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE", "type": "library", "group": "org.springframework", "version": "5.1.18.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:29ad22e9-a034-52ed-98bf-8e2a3d7d5a13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:284639bc-6988-5cf0-b094-2b9c228627e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ac5ccb38-9c9b-5fa6-9302-007ff512ce5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:004be1df-5c95-57ea-8444-5c4c153fe0f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5cbb7081-7af3-5ae4-9740-9a9fb00715c7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket. not_affected \u2014 The target Spring Framework 5.1.18.RELEASE already contains the fix for CVE-2013-6430. The vulnerable pattern is not present because the upstream vendor (VMware) applied the fix in commit f5c9fe69a444607af667911bd4c5074b5b073e7b by Rossen Stoyanchev (rstoyanchev@vmware.com), which was included in the upstream release that TuxCare onboarded. The JavaScriptUtils.javaScriptEscape method properly e...", "justification": "code_not_present" } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:eb5dbedc-d5d2-555d-8b6c-70879273f46c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b1eeb8ac-be5d-5227-938f-cda1d2677d44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ebafd9dc-6062-5321-ab06-f6e8efa65daf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket. not_affected \u2014 CVE-2015-3192 is not present in Spring Framework 5.1.18.RELEASE. The fix for this vulnerability was included in the upstream Spring Framework release that TuxCare onboarded. All XML parsing classes (Jaxb2Marshaller, AbstractMarshaller, SourceHttpMessageConverter, Jaxb2RootElementHttpMessageConverter) have DTD processing disabled by default (supportDtd=false) and set the disallow-doctype-decl pa...", "justification": "code_not_present" } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d62a9e2b-74f1-5559-9674-a5ccf0ac1855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:708d5add-20b3-5568-a5ee-a54ec0c946e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:601ad7cc-bf1f-553a-a761-823e4d503145", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ff12be84-99bb-5156-b366-0f44022e0250", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:26c5bee7-9fe1-5333-9d16-ea7d59ab0c36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5687751b-d455-5fe9-beff-c025278f7d23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1749db89-dc49-5c0c-ab87-9b8c05fa4a13", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework 5.1.18.RELEASE is NOT vulnerable to CVE-2018-1257 (ReDoS in STOMP WebSocket selector header). The fix was committed upstream in April 2018 (ff2228fdaf) before any 5.1.x version was released. The vulnerable code pattern never existed in the 5.1.x line. The fix allows administrators to disable selector header processing by setting the selector header name to null, preventing mali...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:aefa2f2a-82e7-55f1-8454-402755a3cf0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:81e034a5-30e3-570b-9190-563baf05efce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:22376c3a-f381-5bb2-b864-5d0415bee057", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5703a5d5-1869-5c08-b1bc-8da8164f6b2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7904228b-053e-5ef0-ab27-4138c157f0df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c8750997-f30b-51ea-a561-9beea5420479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6bdf5096-f5e9-5e0c-8a17-04ac27464116", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22118 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0904a293-9acc-58e1-8a48-de3049cf6ea0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:66e7c4fb-c336-5b4e-bd5b-56c6a8864669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cae068e3-eb5a-55c6-845f-45de0ddfb86c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:18d0b4fe-e372-5aab-9b33-f97f2695f7d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7fdc3aaf-d1dc-59e6-b2d0-74d2a08abb99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c4ffd6b0-c212-51d9-82c1-6693e97dd8df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4c5be40c-d7cd-5cba-abdc-2da5c5f67982", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b9313241-9c31-53df-bd49-863c1cd1e355", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:92b30671-4d60-51f5-9593-7b8fc1dffa5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:376a4833-8cb9-597e-99d6-0b4ec8def979", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7b05611b-ccdc-50e2-a884-cf0c62865779", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:08feae48-87f6-58d5-9f32-2daccbdf3b47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c030c2e8-7f23-5a58-8d23-e91a3a1179df", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket. not_affected \u2014 Version 5.1.18.RELEASE is not affected by CVE-2024-38820. This CVE concerns locale-dependent behavior in toLowerCase() calls that were introduced by the CVE-2022-22968 fix. The target version never received the CVE-2022-22968 fix and therefore does not contain any toLowerCase() operations in its DataBinder disallowed field matching logic. The vulnerable code pattern is completely absent from th...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2d80615c-4505-53d7-9c6e-5bf878a67731", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4b399e27-e81d-59d1-a24a-c4ce9518bb29", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework 5.1.18.RELEASE is NOT affected by CVE-2025-41234. The vulnerability exists only in version 6.x where a new MIME-style encoding architecture was introduced. In 6.x, when using non-ASCII charsets, the code outputs BOTH filename= (with Quoted-Printable encoding) AND filename*= parameters. The vulnerable Quoted-Printable encoding uses a PRINTABLE BitSet that, before the patch, did ...", "justification": "code_not_present" } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c86f10e4-9925-5269-8734-cde64188d736", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2e18758b-6db9-58df-98c6-c15ba59cd069", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bec04384-f3ab-5cc5-9b09-300c0eb88819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:41bd7e62-32b5-5899-bfbe-9268652b32d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8a51eba7-63bd-52d4-8e81-fa701a9fece6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f254034a-0dc0-5508-93e7-51bca3dd8d6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:aa5df172-3026-5f6f-aa92-677c53ced75b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d0b6aaa8-e93a-568d-a8d6-fcd42180f845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6b7f6bfb-ea4f-5d1d-b900-1e223e2360db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:863335ae-e9df-52eb-b89e-0ba83491713b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9783780f-e527-5ff0-801f-efebc352cc32", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework 5.1.18.RELEASE is not affected by CVE-2026-47885. The vulnerable component `PartEventHttpMessageReader` does not exist in this version. The `PartEvent` API and `PartEventHttpMessageReader` class were introduced in Spring Framework 6.0.0-M4 (February 2022), well after the 5.1.18.RELEASE version was released. This version uses `SynchronossPartHttpMessageReader` with a different a...", "justification": "code_not_present" } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7dbdc643-5d02-5d6d-ab0c-cbaa9a3318c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:692946f3-94e5-5487-a635-3c3b02a5deb1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket. not_affected \u2014 The target Spring Framework 5.1.18.RELEASE does not contain the vulnerable JettyCoreServerHttpResponse class, which was introduced in Spring Framework 6.2+ (January 2024) for Jetty 12 Core support. The CVE specifically affects \"a WebFlux application running on the Jetty 12 Core reactive adapter.\" The target uses Jetty 9.4.31 with a servlet-based adapter (JettyServerHttpResponse extending Servle...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2dd1e9bc-0605-5f79-bb6d-29196fc35fe5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f68882a9-6148-5339-a44f-db933d8f2fb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:64eaac2e-b7ef-58d4-8d83-3ab1cf2a8a4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c89ea7dd-2172-5c22-966d-0f20954a50dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.1.18.RELEASE-tuxcare.1 of org.springframework:spring-websocket." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.18.RELEASE-tuxcare.1" } ] }