{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:549ca296-dbe7-5306-935a-3ea0412bdb31", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3", "version": "5.3.32-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@5.3.32", "type": "library", "group": "org.springframework", "version": "5.3.32" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:0f731108-9c2c-5624-a7c4-43016d48dd60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:181b8caa-046d-5922-b698-83fe401497a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:d2544f1e-9522-5ec5-931d-77f1d2ef2cd1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:9530c5dd-5faf-5f2f-90bc-bab49ecdcff1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:ea65dbcf-a84f-535f-bb49-0ca1222a86a9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-websocket. not_affected \u2014 CVE-2013-6430 is not present in Spring Framework 5.3.32. The vulnerability affected JavaScriptUtils.javaScriptEscape() which failed to properly escape four special characters (<, >, \\u2028, \\u2029), enabling XSS attacks. The upstream fix (commit f5c9fe69a4, dated 2013-02-15) was included in Spring Framework 5.3.0 and all subsequent 5.3.x releases. The target version 5.3.32 contains the complete...", "justification": "code_not_present" } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:b1032ab6-0217-58dd-bd73-96e2b9dd4dfa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:8de71f34-862d-58f0-a36a-69a39f7928e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:68944c35-9223-5a62-b4fe-7425275e7b06", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-websocket. not_affected \u2014 CVE-2015-3192 concerns DTD processing in Spring Framework XML parsers that could cause denial of service through memory exhaustion. The target (Spring Framework 5.3.32-tuxcare.3 at SHA 332413a647) is not affected because the upstream fix authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) on 2015-06-30 was already present in the upstream 5.3.32 release that TuxCare onboarded. All affected co...", "justification": "code_not_present" } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:f9a039b4-b6b8-5ffa-92b6-ffc07b39bec0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:6d12c79b-562f-5d39-a95c-7a3465ca635e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:1d90020a-98fd-5fa6-b55e-9ecdb84842a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:a677189a-d9de-577e-9af9-5d113594fb3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:d9d537fc-acf8-50ff-b539-eb6d8ad4d87c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:8235e79d-0935-503d-b7b9-22e42892497b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:e7a9bac9-2d25-5647-b097-913db2048a16", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-websocket. not_affected \u2014 The target Spring Framework 5.3.32 is NOT affected by CVE-2018-1257 (STOMP selector ReDoS vulnerability). The upstream vendor fix was already present in the 5.3.32 release that TuxCare onboarded. The fix adds a null-check guard around selector expression parsing in DefaultSubscriptionRegistry.getSelectorExpression() (lines 162-164), allowing the selector feature to be disabled entirely by setti...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:947bc7a1-f7e6-5b54-bd1d-c36f29f0be2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:58bd7b35-c951-52d9-9f46-2120547b8ea2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:977d3610-8ff1-544b-b7d9-c64323e1a9f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:519801e3-7db9-5c57-b991-05694421a616", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:caca23a6-1de6-55fa-93aa-54e1ffb3fa49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:54d7a22b-ffb1-50ff-ac84-935bc0c73aa9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:a03328f7-d3f3-5b16-a038-024da821d1ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:6c357f6e-0e11-5cc4-ba3a-ef853f35e784", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:7ef71b52-8a7d-500d-9cd7-99e360647643", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-websocket. Spring Framework 5.3.32 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:3abd10f9-36ca-5414-9bfd-be8bdd16c655", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:c4ad2e44-8079-5a67-ab88-c05593d27931", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-websocket. not_affected \u2014 CVE-2022-22970 fix was already present in the upstream Spring Framework 5.3.32 release. The vulnerability affects applications handling file uploads with data binding to MultipartFile/Part fields, allowing DoS through repeated access to expensive read-only property getters. The fix (commit 83186b689f, May 2022) filters AutoCloseable, ClassLoader, and ProtectionDomain read-only properties during...", "justification": "code_not_present" } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:9865a06c-ecb6-5c31-b916-99b21857f9f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:00e7cfe6-9948-5194-b0b4-c4a7b284c9b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:77e95c58-5b04-5c25-9d86-1c969cc03d9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:21d4a318-2d01-5ac8-a0ea-9a60ec592ced", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:5961180a-ab49-5b21-891f-4b6775d5a998", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:a4aeec5f-557d-5801-b64f-8e02fb4eb8f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:7da1a436-b593-5235-8a99-222b4755d462", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:56df905d-2c6f-5406-befd-5e52131908e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:52d1369a-481d-56e0-a78d-97dde640764f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:009fb667-16c3-5d0a-bd2f-d5c1276a599c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:bbeb674c-cdbc-5d41-a2bc-bb84b2747baf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework 5.3.32 is NOT affected by CVE-2025-41234. The vulnerability exists in version 6.x where both filename= (quoted-printable) and filename*= (RFC 5987) parameters are output when using non-ASCII charset. Before the fix, the filename= parameter's quoted-printable encoding allowed literal double-quotes, enabling header manipulation. Version 5.3.32 uses a fundamentally different archi...", "justification": "protected_at_runtime" } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:b3396e26-384c-5fed-be1c-dd6d0a448434", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:a8e51a51-519a-52c9-b040-0996dbcb4668", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:c131bbf2-7979-5148-a0fb-45f89a1ef101", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:27a47d96-f8bb-57fa-8b2b-5fa88468cc34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:3f2aeb3f-693b-5578-a99f-2c4f5571d139", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:1633a6d5-83b1-528d-9ebc-4077e3e2b317", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:a2a40ffd-2e9b-5f98-a8e9-191df38b732f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:97dc7d9f-3726-5079-8086-2686077e2c2d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:2b205a5f-34a4-5d74-a6dd-0a192664c2e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:8bc88f0d-e1d6-59eb-b94c-3f53d9b60738", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:7f8e863a-3a5d-5da8-8c51-79bef1a011c7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-websocket. not_affected \u2014 CVE-2026-47885 does not affect Spring Framework 5.3.32-tuxcare.3. The vulnerability is specific to PartEventHttpMessageReader, a class introduced in Spring Framework 6.0.0-M4 (February 2022) that does not exist in version 5.3.32. The CVE describes a bug where maxPartSize limits are not enforced when maxInMemorySize is set to -1, but version 5.3.32 uses different multipart readers (DefaultPartHt...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:69e98ca9-5d66-53cb-945d-7a57d1c8573c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:42028a2a-a0d4-5e39-9810-9166e5130034", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework 5.3.32 is not affected by CVE-2026-47889. The vulnerability is specific to the Jetty 12 Core reactive adapter (JettyCoreServerHttpResponse class), which does not exist in version 5.3.x. This version uses Jetty 9.4 with a servlet-based adapter (ServletServerHttpResponse) that correctly serializes the sameSite cookie attribute via ResponseCookie.toString(). The vulnerable code pa...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:7c578c9e-4564-542c-a7b1-3aa9435607e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:61784141-9313-55b2-9a07-c121a25bb959", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:33adbe42-d7cf-51cd-80a4-79c4dbe9c148", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:0427231c-08bf-57bd-bd7d-00c6ca70a05b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-websocket." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.32-tuxcare.3" } ] }