{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:68156688-b499-5ea8-8eca-c9ca13803d02",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-websocket",
      "purl": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7",
      "version": "6.1.16-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-websocket",
            "purl": "pkg:maven/org.springframework/spring-websocket@6.1.16",
            "type": "library",
            "group": "org.springframework",
            "version": "6.1.16"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:1d1086f4-3221-50ce-afa2-d941f5de1b71",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:bc29c960-dfc9-5bd1-9127-bfda2ddc8a87",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:475028b8-fdf4-51bd-8973-b04a2f6a0e43",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2013-6429",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:b5286b77-dac2-5dff-859b-ec08e82e8e1e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2013-6429 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2013-6430",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:264d02c1-2066-5284-b724-a300b90a9117",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2013-6430 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:dab36ca1-8503-5d8e-9269-91e9bbeffa4e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:7db9452f-d7f7-5511-b4ed-b353648dd2a0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2015-3192",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:2ba64d62-078c-57bb-b4f2-97324aa7d0e2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-3192 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:b0196b22-efb3-5e22-b928-3c3704b7e977",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2016-1000027",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:f350f806-dcbe-55ff-bbe8-ded79bdf48d2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:9d1cf6b5-cc29-56d7-b320-8afb86d6df2b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2018-11039",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:deb77fa9-4196-553a-88ab-629824c2ef2e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11039 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:6925cbc6-0a9f-5564-8061-de2feb2cea31",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11040 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:e88e7130-a3ef-5f36-aeac-6e4a98a31442",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:4bd38477-f948-5607-bf35-ff80f3a85e60",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1257 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:38b9709b-bd14-5a11-b380-529d87b779ef",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:397a39b6-653b-5532-8e62-6258c3f2da55",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1271 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:1ca01c04-5299-5099-9275-7143c18306fb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1272 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:b0d3d467-7fd2-558a-ab78-feafd6a7d557",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:9eba4e24-7bb5-5da6-8d9c-e4c7463939dc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:af42e015-4b55-5578-8f72-793092d4c9e9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22096 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2021-22118",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:30c9c3f2-0a48-59dc-ad13-7af1d9ef6c37",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22118 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2022-22950",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:c52bc30f-8445-5c9c-9e41-c13229c811aa",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22950 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:2eb263a3-831e-5376-82e4-29a960e97d6d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22965 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:7e1a0942-2776-52f5-999c-74dd15cb0d34",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22968 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:a6780007-c396-5e22-b258-42df3df347ad",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22970 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2023-20861",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:b22c13e6-9ddd-5f74-9109-6d252468da45",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-20861 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2023-20863",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:738172c2-b087-5aad-aa20-d2a70588f757",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-20863 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:a2f7fd16-8592-528e-ad0c-1abf6b3c1fbe",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2024-22243",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:f3ef4215-722d-5014-a81c-2e33a9824874",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22243 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2024-22259",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:375fc27e-4f3a-5756-8f57-9e683a929c2b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22259 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2024-22262",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:a3dba2e9-afb3-5387-9cb9-b81345312296",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22262 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2024-38808",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:8a7c7a07-301c-5a9a-a979-bdcc9cc6cb2e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38808 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2024-38809",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:fcdc8216-ecbb-5ff7-803a-b6b1aa871c59",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38809 does not affect version 6.1.16-tuxcare.7 of org.springframework:spring-websocket. not_affected \u2014 CVE-2024-38809 does not affect Spring Framework 6.1.16-tuxcare.7. The vulnerability (ReDoS in ETag header parsing via catastrophic regex backtracking) was fixed by upstream Spring Framework in version 6.1.12 (commit bb17ad8314 by rossen.stoyanchev@broadcom.com on 2024-08-14). The fix replaced the vulnerable regex pattern with an efficient O(n) state-machine parser in a new ETag.java class. TuxC...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:d7b93444-9a16-5c72-8805-2732d4f930e6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38820 does not affect version 6.1.16-tuxcare.7 of org.springframework:spring-websocket. not_affected \u2014 CVE-2024-38820 is not present in Spring Framework 6.1.16. The upstream release already shipped with the fix (commit 23656aebc6, using Locale.ROOT for case conversion). A subsequent TuxCare backport (CVE-2025-22233) replaced this with simpleMatchIgnoreCase(), which is also locale-independent. The vulnerable pattern (toLowerCase() without Locale.ROOT) does not exist in the current code.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:e64bfb45-0a76-5ab1-bfeb-ed5709dec29f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2025-41234",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:889020ae-2244-51d4-a313-bd20cbd8262e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:8d79ecac-7e6b-5085-a1ca-328c38e8089f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2025-41254",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:d748e890-c2ad-5152-9eb6-50c31982ba34",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-41838",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:475afabc-ba4e-55d3-81c6-9b6961439a72",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-41845",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:0034bbf4-d359-57f3-b40a-90be014fc1bf",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:37f2b35e-db98-577e-8c78-72cd21d800bf",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-41849",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:903f2a03-8064-5459-b7e7-6bf704dd1f22",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41849 affects version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-41850",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:7c3e2331-7db2-5f06-8062-0cc992e35f81",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-41851",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:d3cc5221-209d-55ab-8507-fd2aab74d4d0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-41852",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:9c3b0cd3-c075-56a8-a67c-9b209bfa37d9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-41854",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:859fbb3b-07b1-5b8f-bb96-f49f59a638bc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-47885",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:b7e5d931-ff59-5b14-ba2a-815183df8a4e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-47886",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:879a68b2-74a3-5a77-96ed-36bec429b90a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-47889",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:85331f14-ffb1-551d-a34e-6e2ac32e24c5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47889 does not affect version 6.1.16-tuxcare.7 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework 6.1.16 is not affected by CVE-2026-47889. The vulnerability exists only in the JettyCoreServerHttpResponse class, which is part of the Jetty 12 Core (non-servlet) reactive adapter. This adapter was introduced in Spring Framework 6.2.x and does not exist in the 6.1.x branch. The target version 6.1.16 only has the servlet-based Jetty adapter (Jetty12ServerHttpResponse extending S...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-59281",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:25171776-1580-5407-87f6-6c24671ae3d8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:2f8ef009-2f7c-5875-95d4-4361a6ac53d3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-59283",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:e40367d4-af21-5e9b-8f0d-46fa20fb0192",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    },
    {
      "id": "CVE-2026-59314",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:d3f1da85-34f4-57d7-a8ec-f374492c03a8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-websocket."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-websocket@6.1.16-tuxcare.7"
    }
  ]
}