{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:40bd857e-ddd0-58f1-8ca8-6ff4da37d779", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11", "version": "6.0.23-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:3e5281f4-42a2-5635-9473-b40bf9040cc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:e40ee565-0e3a-5527-aad3-57eda8e71d81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:937df14e-b866-56f6-823c-464843df5e4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ef163df6-f0aa-5a45-a6c7-c2e250f357d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:42c9d7ae-82ef-516b-baff-9c449d9e1b0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6430 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:8e86a1d0-9390-5d5a-a6af-9cedecc8a815", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:5424e79b-160f-5f7c-899c-c1094baf61fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:a09722da-6411-5391-bf34-9ace206e7dcf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework 6.0.23 is not affected by CVE-2015-3192. The upstream fix disabling DTD processing by default was committed in June 2015 (d79ec68db4 by rstoyanchev@pivotal.io) and was already present in the official v6.0.23 release that TuxCare onboarded. All XML parsing components (Jaxb2Marshaller, AbstractMarshaller, SourceHttpMessageConverter, Jackson2ObjectMapperBuilder) have `supportDtd=f...", "justification": "code_not_present" } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:9b547c21-3606-543c-9ca4-df20d304baff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:f52efe79-e0e0-5ccd-88f6-aad567fd2935", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:2e78f857-e273-5ee8-9b38-0a22a9c01dc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:2f0f6cdf-87dd-582b-9f54-15e21ecd05dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:0661eab3-5ced-5f76-8dbc-e06bcd6e7004", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:4a087fbb-12f5-5c30-96de-c81400974c4c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:f3be03ce-d720-5d25-85c0-2ecafa3280af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:f8ff06f9-f3b0-5d81-9ba5-948f5648e7f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:0043a978-db51-5a3d-b8f6-6938d10738f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:fe585f1f-34fc-5250-b850-51fbb43538e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:6d215b32-041c-5e5d-b3bd-6d75ce2e6025", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:7692d36d-3427-5bc8-b5b6-700f1d2f03e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:90c2dd95-fa88-5dbc-9890-74b39907e890", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:57c06af2-ce68-5b4b-8575-4314df8f6904", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:439265ed-92a0-5541-8ce1-8a2eba268d86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:8ab6f76c-ae0d-58cd-b0f4-3a48d12154c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:a50452e2-99d5-5d7d-b1d8-b024c53ea019", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:602ccbda-ad3b-55c8-8ac5-41e7e731d485", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:6a764ca0-c336-5700-acb3-ed5a8d27416a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:dd9eb6bc-e702-52c0-bd22-c4d7bbd389fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:78adc2f3-4906-5923-8cce-bf20498bece1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:7f9080b6-26c5-5910-bd1e-d92af83be416", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ffeeb9dd-abc4-58f4-97e5-410d7cdf5be7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:020c7fbf-37c8-5de4-bbee-4c70dc2ba370", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:0effb9df-d6df-50b0-9fc7-88ec97d9959f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:f8660e51-4766-55c6-ae8d-3ce6d8ef26a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-websocket. not_affected \u2014 CVE-2024-38809 affects Spring Framework 6.0.0-6.0.22 with a ReDoS vulnerability in ETag header parsing. The target version 6.0.23 is the upstream FIXED version. The fix (commit 8d16a50907c1 by rossen.stoyanchev@broadcom.com) was shipped in the upstream 6.0.23 release that TuxCare onboarded, NOT added by TuxCare backport. The vulnerable regex pattern (ETAG_HEADER_VALUE_PATTERN) has been replaced...", "justification": "code_not_present" } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:555649ea-ad07-5b49-8f2c-c0f8492cc73b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:b3f72897-f16b-51b2-ad88-52cc48e338b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:dad9c704-07c7-537a-9807-4c0eda42c2b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:9b055b25-c644-56f3-a836-3183af0d671c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:80b8c70e-6d9b-5b66-9277-6a418134a99e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:44db0b0f-6de6-50a5-8772-ca48807140b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:b0387d55-a911-5a54-873f-ad5f9e9c28db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:51e66e5b-170d-5624-acb8-136a72770335", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:b883ae53-f30e-547d-8ea0-9c495bd9345f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:c5aa8f00-2346-5a62-baad-a7975a047e22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:14a374c3-2a51-54d1-9a6b-1e9db5bdcf9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:eec839b4-d509-5bc7-bc43-00938aa04de0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ad4608da-fdc6-53f5-882c-e9ebc00584e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:39868c0f-08d1-583f-a975-4c835d9aa389", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework 6.0.23 is not affected by CVE-2026-47885. The vulnerability describes a bug in the maxPartSize feature where maxPartSize limits are not enforced when maxInMemorySize is set to -1. However, Spring 6.0.23 does not have the maxPartSize feature at all - it was introduced later in the 6.1.x release line (commit 66aac7e359, Oct 2023). Since the vulnerable feature is not present in 6....", "justification": "code_not_present" } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:483484f8-9285-51d0-9298-dfdde2cc5691", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:bce61620-05ad-50eb-8f1e-a5bed4619eb2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-websocket. not_affected \u2014 Version 6.0.23 is NOT affected by CVE-2026-47889. The vulnerability exists in JettyCoreServerHttpResponse.java, which is part of the Jetty 12 Core reactive adapter introduced in Spring Framework 6.2.0. Version 6.0.23 predates this feature and only contains servlet-based Jetty adapters (Jetty11ServerHttpResponse and Jetty12ServerHttpResponse), which correctly serialize the sameSite cookie attrib...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ce94ef42-3d05-5774-ade8-ba4b2498c684", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:a812154d-c7b3-53b9-adad-160540df330a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:2bb87063-0c92-5d8e-9dc2-61e97e2d8f53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:09af7511-2169-5a56-a8e9-def076b61587", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-websocket." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.23-tuxcare.11" } ] }