{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6a32cd06-c969-5315-91e2-8c24034429c5",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-websocket",
      "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1",
      "version": "5.3.33-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-websocket",
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.33"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4899e1a0-606a-51c3-8a14-244d6037e30c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0f46b23f-53d7-5666-8d6c-352ef7dad730",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6ce4f754-cdcf-588a-954e-b0742dde43c6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2013-6429",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:016fa8da-b690-5d02-8b11-4c7ec8abb0cd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2013-6429 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2013-6430",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:13d7daeb-4f6c-5e12-9b9d-051f62ceac4d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2013-6430 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:16619667-4dcb-5963-a864-c17ea26bbfd5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fadf0f0d-dbfa-5b4f-bc78-27f02875c733",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2015-3192",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:efa1a64d-c1d6-58c3-b3b8-785c851c7361",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-3192 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:55fa665e-259d-5ffa-8fa0-d9105dca6943",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2016-1000027",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:109cbdb6-6c2a-539c-a34b-ef3bc49b5c7e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required",
        "response": [
          "will_not_fix"
        ]
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:57f1beec-86f5-5f8a-88b0-766c233873ca",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2018-11039",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d62b9dcc-d204-5fb1-b06e-e95fbfd63c48",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11039 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:00cc6ab2-96dd-5894-9429-4c9db4ef459e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11040 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e9807d36-6d1b-5017-9596-e7aeba8b7d3a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ecce90ff-9f28-5370-9cb7-182413c01c7b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1257 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:17bbdb2a-7785-5bfe-93fb-fb78b1ef91df",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:88493eda-0ce5-5b94-95aa-52e71de24dab",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1271 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:17f29ab0-9a87-586e-9fa8-94e7c5745fae",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1272 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e6886e38-955d-5b69-8c32-27846149b977",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f7241981-c2c2-5ac8-bd43-9652d49d3d8c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bdc22e88-a3cb-5511-8b44-c3e79a32f5a1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22096 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2021-22118",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5b790fa2-2693-5fd9-9cb1-47f6c7102019",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22118 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2022-22950",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:145b2b6f-2b43-545b-9633-eff8184c48e7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22950 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a8c12610-d22a-58d4-b4fb-06f54eee8cb4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22965 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:994726ce-6d9c-593f-b4bf-4445e52b5b79",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22968 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ae1b4760-6598-5eb2-acd5-9a12fe0ce993",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22970 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2023-20861",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8c00a245-1908-59e7-b166-f15f4805c9e0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-20861 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2023-20863",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cb6b574a-42bd-5aa5-957f-73a082898852",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-20863 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a127dfce-54fe-5071-9491-1d6f076a6fe8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2024-22243",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:208623e3-edf1-5244-8332-8d2cbead41ff",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22243 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2024-22259",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c75f0933-e5aa-573c-a2fc-2711cceccf11",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22259 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2024-22262",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:46c305ff-90b8-5fc0-9abb-dd5fdb7f3952",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22262 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2024-38808",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:54860410-f438-5370-a937-cb3562b32920",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38808 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2024-38809",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:33e2e4ab-6def-59fb-895b-1c58a35c0b2d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38809 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket, and is fixed in 5.3.33-tuxcare.4."
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:839b42d7-82b4-5a1e-988e-167349b61d83",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b556f9b5-e9f2-5a57-ba6b-6bbd57a055a7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-22233 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2025-41234",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bc30e16e-a713-5d8a-b36f-0067ca51d767",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-41234 does not affect version 5.3.33-tuxcare.1 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework 5.3.33 is not affected by CVE-2025-41234. The vulnerability exists in the quoted-printable encoding feature, which encodes non-ASCII filenames using RFC 2047 format (=?charset?Q?...). This feature was added in Spring 6.0 (commit 58fbf60d2d, Feb 1 2023) and does not exist in 5.3.33. The target version uses only RFC 5987 percent-encoding for non-ASCII charsets, which properly enc...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1bed41a4-b158-5468-a5e6-2e61a46a5334",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2025-41254",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c3bf4c60-46cf-5efc-af87-72620a1b1e13",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41254 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket, and is fixed in 5.3.33-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-41838",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cc4af152-dc1b-50f9-b55d-4d56e57a124e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-41845",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0ba7382f-e77c-53b4-b019-f16a990ceb6b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7be18a8a-6a3c-54e7-b375-aea53757997d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket, and is fixed in 5.3.33-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-41849",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:41df8e0d-628c-56b6-b4f9-52a78b784139",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41849 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-41850",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:25321d97-3b7a-537d-aa7f-2a00cc24336f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket, and is fixed in 5.3.33-tuxcare.4."
      }
    },
    {
      "id": "CVE-2026-41851",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:03214ca5-586c-5809-b921-f4e0da7fc055",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket, and is fixed in 5.3.33-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-41852",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:04e74aae-c21b-5f51-ab57-fa9085547900",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-41854",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2b063b1b-dc0c-51db-bd2e-7df8dd771744",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41854 affects version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-47885",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:633bee0d-00e2-5017-ba0a-2bc2f2ac8967",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47885 does not affect version 5.3.33-tuxcare.1 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework 5.3.33 is not affected by CVE-2026-47885. The vulnerable component, PartEventHttpMessageReader, was introduced in Spring Framework 6.x and does not exist in version 5.3.33. The CVE describes a vulnerability where PartEventHttpMessageReader fails to enforce maxPartSize limits when maxInMemorySize is set to -1. This class and its associated PartEvent API are absent from the 5.3.x...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47886",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:33f9cd7e-6271-5f35-a407-2cf590d9ba5b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-47889",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6501aae6-0e66-511a-a3de-3382c8272eae",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47889 does not affect version 5.3.33-tuxcare.1 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework 5.3.33-tuxcare.4 is not affected by CVE-2026-47889. The vulnerability is specific to the Jetty 12 Core reactive adapter (JettyCoreServerHttpResponse class), which was introduced in Spring Framework 6.2.0-SNAPSHOT on 2024-01-15. This class does not exist in version 5.3.33. The target uses the servlet-based Jetty adapter (JettyHttpHandlerAdapter) which correctly serializes the sa...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-59281",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:af79fe64-3e6a-561d-8951-6549fa72d4bb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8b59429c-acc6-52ad-928d-431a7b4e2eda",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-59283",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cd0fe409-f97c-5fd8-afd1-0804a891d935",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-59314",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:925bc671-d69a-5b93-9588-37826d35e576",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-websocket."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.1"
    }
  ]
}