{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a4059e78-620b-5b28-98be-85f4723eb422", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10", "version": "6.0.23-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:c1504f54-a88d-5e8e-bb8a-569c295cb85b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:e91b6e87-e41f-518b-82ad-bef9e82a3b15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:20f86f2b-5b0d-5422-a446-6d49416c3672", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:b701975d-6398-5ed4-8bab-260c75902654", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:da44ca36-52e3-5384-b4d6-01ba7009f45f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6430 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:17ca4dc6-ce54-574c-bef4-a76245e27002", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:aa835fbc-8016-50f5-bf34-971e5ea057d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:7bd12162-d45b-5284-8015-69a4c9ea1a6f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework 6.0.23 is not affected by CVE-2015-3192. The upstream fix disabling DTD processing by default was committed in June 2015 (d79ec68db4 by rstoyanchev@pivotal.io) and was already present in the official v6.0.23 release that TuxCare onboarded. All XML parsing components (Jaxb2Marshaller, AbstractMarshaller, SourceHttpMessageConverter, Jackson2ObjectMapperBuilder) have `supportDtd=f...", "justification": "code_not_present" } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:85193e0a-5876-51ce-8efc-8d76df592f36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:4a397d62-529b-5a76-a934-075578125507", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:a05ab1a0-1458-5ac1-bb40-84931c2e3aad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:f922c8c6-2ca4-5f33-b955-8987a5e37a83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:ed168176-ceec-51bc-976f-c259a171b701", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:ddec03c4-5b34-52ac-a53e-375bfe62e34d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:944b9f01-efed-5847-9fdf-871d6720981c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:6558edee-2ade-5f33-828f-98592959381e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:aee4481e-4aac-5cfd-aa66-1c5f492ffc97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:94d0a713-0a72-5f56-be75-b12084267a41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:3f8e94bd-0bd6-5509-bb66-dcde273d4ac0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:5e68528e-bb18-5679-9531-2105d62f4d62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:404f3d52-9d9c-5c83-923d-bf369638889e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:706c6178-e135-5c10-bb96-7689b75bd273", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:96934cae-6d98-56ec-a29d-959a5b9f83fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:3fd67cb0-c2be-5058-a2e1-9c9644326415", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:a78751bd-474e-53e7-8557-1037c8c7ae3b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:af4d9d6d-8060-5cda-8c76-e4560ec5d7c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:bd79f874-cfce-57b8-8d73-9c923a55713b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:01cc5e91-fff2-517d-a832-0605292bf5ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:1bb39c07-1714-5665-a166-dd167d2adc5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:c07809a7-f82b-59b6-afc1-2888bd8f4e49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:f95dc68e-78ca-589e-b7fc-6583a833613d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:7046bf5b-c61d-51eb-9761-c2e913b5dbc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:c19e7441-cd88-537c-b212-25bd5e870731", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:936e3084-a516-5632-b8ed-270c369e5b1e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-websocket. not_affected \u2014 CVE-2024-38809 affects Spring Framework 6.0.0-6.0.22 with a ReDoS vulnerability in ETag header parsing. The target version 6.0.23 is the upstream FIXED version. The fix (commit 8d16a50907c1 by rossen.stoyanchev@broadcom.com) was shipped in the upstream 6.0.23 release that TuxCare onboarded, NOT added by TuxCare backport. The vulnerable regex pattern (ETAG_HEADER_VALUE_PATTERN) has been replaced...", "justification": "code_not_present" } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:5dcf805f-6e83-5a11-8030-59304d54c8c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:ef827a08-8bae-58cf-a690-3c9e57b2e54a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:6658509c-bcdb-5ad6-a629-9f2474cb0f46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:b1b1f673-07aa-5dde-b936-45e60f596363", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket, and is fixed in 6.0.23-tuxcare.11." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:ab720917-d083-5623-aeae-1f5c39501361", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket, and is fixed in 6.0.23-tuxcare.11." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:ad44fca6-db0b-5119-923c-60a70fec3ab4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:a5b619ce-b909-56b1-a940-63df57187e9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:c1daa2e2-76e0-56f6-846f-ea2817ae94ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket, and is fixed in 6.0.23-tuxcare.11." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:29c42391-91b5-5b2a-91cd-682b602bb553", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:ee9c48ce-e66e-5f2c-af2b-5afc95a82297", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket, and is fixed in 6.0.23-tuxcare.11." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:33056b77-cd38-5a6e-aec4-4a6fbce9594f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 6.0.23-tuxcare.10 of org.springframework:spring-websocket, and is fixed in 6.0.23-tuxcare.11." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:54a16e7f-8dc2-59c4-8c34-0e41ceeedf26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:d45a726c-e096-5399-ba34-09679ad3cd82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:4cf2112e-7098-5dbd-a558-57815c1cc7f6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework 6.0.23 is not affected by CVE-2026-47885. The vulnerability describes a bug in the maxPartSize feature where maxPartSize limits are not enforced when maxInMemorySize is set to -1. However, Spring 6.0.23 does not have the maxPartSize feature at all - it was introduced later in the 6.1.x release line (commit 66aac7e359, Oct 2023). Since the vulnerable feature is not present in 6....", "justification": "code_not_present" } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:f16d4fc4-92fb-539e-90a9-0102fdeef538", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:519fb66d-c1f1-5957-9bbb-480882d0f149", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-websocket. not_affected \u2014 Version 6.0.23 is NOT affected by CVE-2026-47889. The vulnerability exists in JettyCoreServerHttpResponse.java, which is part of the Jetty 12 Core reactive adapter introduced in Spring Framework 6.2.0. Version 6.0.23 predates this feature and only contains servlet-based Jetty adapters (Jetty11ServerHttpResponse and Jetty12ServerHttpResponse), which correctly serialize the sameSite cookie attrib...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:595e91d7-29dd-584e-a734-fbb06da9ffd2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:f5cee7a7-e3b7-50e3-b207-b1885ff5b900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:8bf8e5ce-aff4-5ec3-a7be-8b447cd98ad9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:1d671a8b-cbee-5859-bc20-ec808c9d585e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-websocket." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.10" } ] }