{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:84f56b00-78ab-533b-82a7-bf4c29f96636", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1", "version": "5.3.32-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@5.3.32", "type": "library", "group": "org.springframework", "version": "5.3.32" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:da691ed1-f21f-53a7-bc45-6ac0bd998d12", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:bf79efbb-1f32-5d06-8abd-7d89470a13ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:9932cc93-8a6b-5d8d-bcbf-cc33c12b6cda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:3c1c59a4-591e-5dcc-bbe5-e7afa753fe5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:2e2de2b6-d6a8-545d-bb04-4913dbfde593", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-websocket. not_affected \u2014 CVE-2013-6430 is not present in Spring Framework 5.3.32. The vulnerability affected JavaScriptUtils.javaScriptEscape() which failed to properly escape four special characters (<, >, \\u2028, \\u2029), enabling XSS attacks. The upstream fix (commit f5c9fe69a4, dated 2013-02-15) was included in Spring Framework 5.3.0 and all subsequent 5.3.x releases. The target version 5.3.32 contains the complete...", "justification": "code_not_present" } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:eed9bd01-870d-598f-a16a-ecc4b15eeb78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:3059b216-145e-5138-b62a-841c5d908d5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:7d0aa0ce-6ad3-524a-846f-615a31215d63", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-websocket. not_affected \u2014 CVE-2015-3192 concerns DTD processing in Spring Framework XML parsers that could cause denial of service through memory exhaustion. The target (Spring Framework 5.3.32-tuxcare.3 at SHA 332413a647) is not affected because the upstream fix authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) on 2015-06-30 was already present in the upstream 5.3.32 release that TuxCare onboarded. All affected co...", "justification": "code_not_present" } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:606d3cfa-b823-50de-aec6-e65a3a70e3d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:b5926610-8e52-55dc-ac58-0db0ea23ac01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:adb9f66c-409e-53e9-bc87-a8f077700842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:3270a5fb-de31-52cd-8bff-b4a6eb603941", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:440354e1-17f9-54e2-95df-b32ae260dbca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:d44b14ca-e2b2-55bd-b857-1346250a8dd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:4b237850-1f87-5c90-a761-c76fc22df80f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-websocket. not_affected \u2014 The target Spring Framework 5.3.32 is NOT affected by CVE-2018-1257 (STOMP selector ReDoS vulnerability). The upstream vendor fix was already present in the 5.3.32 release that TuxCare onboarded. The fix adds a null-check guard around selector expression parsing in DefaultSubscriptionRegistry.getSelectorExpression() (lines 162-164), allowing the selector feature to be disabled entirely by setti...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:cb091175-3c32-56fd-aa86-4670fbe7857b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:6a34b89b-11c9-5e46-9428-eadd7a07cc71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:c6bd437a-2107-539b-8813-1f6fd26c4c37", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:c9d6d1ef-dfea-5d0b-90f5-88eb8032494f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:579e4992-cd36-59ad-9135-b132e9b2fa2f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:80bec078-695c-539f-9d7e-9b774d2da954", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:1cb2997b-40e7-5c0f-bbdc-eebc1d9cbb1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:85e1a9e7-ca7d-5b8a-a374-a4ac7e801b87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:aab80794-5668-557a-8d1e-e9a39889b9dc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-websocket. Spring Framework 5.3.32 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:79744147-0ddb-593e-b252-949543143573", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:e62f9765-38ab-5359-a7e8-4ac4bf87019c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-websocket. not_affected \u2014 CVE-2022-22970 fix was already present in the upstream Spring Framework 5.3.32 release. The vulnerability affects applications handling file uploads with data binding to MultipartFile/Part fields, allowing DoS through repeated access to expensive read-only property getters. The fix (commit 83186b689f, May 2022) filters AutoCloseable, ClassLoader, and ProtectionDomain read-only properties during...", "justification": "code_not_present" } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:ed12fa0f-0021-52d0-8755-169efef86313", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:16454da7-f640-5a21-b5c8-f95ade1e64ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:02d9821c-b476-5b87-9e02-5872c96eb7f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:e5c0faae-3726-5304-a821-5677a908c745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:55da11a0-b57e-597c-a102-aa265acacbed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket, and is fixed in 5.3.32-tuxcare.2." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:f0e0b7b3-273b-5138-b2f7-4504a77ba442", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:8cfd8120-df97-5d15-b71f-18087aaf08b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:702f23af-1f0d-5e42-b9a5-df0b37db08c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket, and is fixed in 5.3.32-tuxcare.3." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:977276a3-8904-52ce-beb8-f26cee76adbc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:11d04be8-d4a3-5338-899d-273e9dc8378a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:e21634d4-6e71-5984-8c7e-94cd19fd3af4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework 5.3.32 is NOT affected by CVE-2025-41234. The vulnerability exists in version 6.x where both filename= (quoted-printable) and filename*= (RFC 5987) parameters are output when using non-ASCII charset. Before the fix, the filename= parameter's quoted-printable encoding allowed literal double-quotes, enabling header manipulation. Version 5.3.32 uses a fundamentally different archi...", "justification": "protected_at_runtime" } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:7e9ccb52-43d3-5d8c-b500-055f7845a5d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:5ab32f46-5084-535f-83dd-6aa57ddff444", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket, and is fixed in 5.3.32-tuxcare.2." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:add29f03-4f18-53a8-8d9f-7e7490b5fafb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:6e96c82a-ec15-5d4d-a647-d6f4ccbc750a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:58579502-f45e-53e9-a875-a01630280872", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket, and is fixed in 5.3.32-tuxcare.2." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:b48351c3-bf03-57db-b334-2d8bf0c05cbf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:f3e3bb87-78af-5064-ab44-576180277c61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket, and is fixed in 5.3.32-tuxcare.3." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:876f030c-eb39-52eb-b7a8-416e5dd1886f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket, and is fixed in 5.3.32-tuxcare.2." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:d6a83cb0-6673-58be-8b9c-b52c68624b2d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:0d59a140-81f1-5501-9ab5-9a35d0ae9e4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:1de64b2f-d625-5414-85f1-20cb97ddd19a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-websocket. not_affected \u2014 CVE-2026-47885 does not affect Spring Framework 5.3.32-tuxcare.3. The vulnerability is specific to PartEventHttpMessageReader, a class introduced in Spring Framework 6.0.0-M4 (February 2022) that does not exist in version 5.3.32. The CVE describes a bug where maxPartSize limits are not enforced when maxInMemorySize is set to -1, but version 5.3.32 uses different multipart readers (DefaultPartHt...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:a9be9848-2164-51a9-95af-460f61c72824", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:9e0c0907-19c4-54cc-8a22-273afbb704ce", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework 5.3.32 is not affected by CVE-2026-47889. The vulnerability is specific to the Jetty 12 Core reactive adapter (JettyCoreServerHttpResponse class), which does not exist in version 5.3.x. This version uses Jetty 9.4 with a servlet-based adapter (ServletServerHttpResponse) that correctly serializes the sameSite cookie attribute via ResponseCookie.toString(). The vulnerable code pa...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:7c007633-4a8c-5531-ac3d-5729dee37c79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:20df9d67-6de4-5ed6-b59c-5be4ec814606", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:6f8183be-91f5-5693-b7cb-3a87138e90c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:9d958f01-43df-554a-8fa5-1f60e5a4ef3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-websocket." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.1" } ] }