{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:43b5f58b-89e3-5793-b5b4-fc68b16141bd", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10", "version": "4.3.30.RELEASE-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.30.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:2dee60e0-9213-5d1a-9977-c9f5268cc964", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:ea12594a-d218-5f6d-8b03-b6f8425020cf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket. CVE-2020-5397 doesn't affect spring-framework 4.3.30.RELEASE", "justification": "code_not_present" } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:3a1d2c58-ade7-5264-8b0f-dd5a352d5e75", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket. Version 4.3.30.RELEASE is not affected by CVE-2020-5421: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 6327c60912cd80120040c8c16c3731d8bf6c19f6\". No backport needed." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:19a97a53-9bda-57a0-a0a7-47c996681d59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:7b673b38-90d8-5cee-a016-64837e2060f8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:6b13facb-8782-59ed-960b-6ea58954b0b8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket. Version 4.3.30.RELEASE is not vulnerable. Summary: Target repository is Spring Framework 4.3.30.RELEASE-tuxcare.2, which predates the introduction of WebFlux. The vulnerable code (reactive multipart handling with predictable temp directories) does not exist in this version. CVE-2021-22118 specifically affects WebFlux applications in Spring Framework 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. WebFlux was introduced in Spring Framework 5.0, and the vulnerable multipart han [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:13c4dc9f-8102-5f83-a283-6c5d059d50c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:65e73b8b-b4bc-591d-873d-58e85571184d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:6534ad9d-f2c1-50e4-a23a-fccbfcee24e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:0bb25c40-bbf3-5d4a-b75b-82929ee740b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:b6a1d503-fd8e-5029-bfa0-465fc7f55531", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:ac27548f-ece7-51c2-b276-f37c2c030cf3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:c716ac7b-d518-5ba6-b4f9-380c7bee31a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:fd9a7635-5610-58ee-b112-8f8bdd1f138b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:0277f562-0ad2-5271-b552-473c33577c48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:01c9b3f7-e96b-552d-a01e-c57e5a4c83af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:56550965-355e-50e3-bccf-6e8bce67353f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:a0ed6538-a33f-5014-8989-f992df206bd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:6a40eb00-df74-512e-a30a-535d8e5aa0de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:0e704251-d0f0-5e31-88ab-63078cfac313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:9d524a51-a917-5cc7-b94c-7abced053134", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:c9b6d89e-7e6d-52cc-9d9d-c2b07efd25e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:c200b3b7-e54e-5b18-afb5-ccd0ea2b5d5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:8ebb32f8-1640-5f5f-ba7f-5da5c7f1432d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:3748f4cb-cdf1-50bb-b82e-e841e08bd220", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:ac8e3bf3-9614-5b71-9358-20964e230c69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:cd01bc7e-f6fd-573f-8557-10a3ef21d130", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:7c78e6f1-3afa-5e8f-8cfd-7dba1c0a1d4b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 4.3.30.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 4.x is not in the affected range.", "justification": "code_not_present" } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:1b6de838-d987-5466-af6c-eed43cb2d49c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:1a6631ae-a117-5c0b-8979-dcbd7972e0f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:e192ac0b-7d50-55ba-801a-2c818d0f41ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:07cc12d3-4ae7-5b38-97ee-db3c135ca62d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:2f0a03e5-d717-53fb-a78e-075d92a04342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:49700714-4957-531a-91b5-71536ce46cf5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:c44de032-9aba-5079-904f-503f11d98011", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:41cc72f6-a4be-5afa-9ed4-4e9a8aff72d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:f3bc6402-3c54-51ff-a6f4-ef188e1824a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:00d13339-2a92-5632-8d6a-9ee08b5e4596", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:af10877e-8410-57b2-9b84-d3aef43794ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:cc7bd63a-668b-5346-a642-0a3281187429", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:97547bb9-c7bc-5eab-9c50-6f014b4ee94d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:90a70e33-1e24-5fd2-ac1f-56456e104e23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:af4064f4-98e6-5798-ac44-3d71df4a5aed", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework 4.3.30 is not affected by CVE-2026-41853. This version predates Spring WebFlux (introduced in 5.0) and lacks the vulnerable component DefaultServerWebExchange.java. The vulnerability mechanism - Spring Framework's message reader selection based on wildcard Content-Type headers - does not exist in this servlet-based Spring MVC architecture.", "justification": "code_not_present" } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:8971daf5-5887-57cb-a5e7-02e38478f55b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:fd3d875f-4bf0-52cd-8be5-9b2212305c9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:9b88bf81-6c5f-5036-9fa8-1010d4e7451e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:5823e5d9-2348-5d33-9ee7-d5691054c377", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:f965cc74-d348-555d-bdd5-2a30030a43b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:5579262b-38df-59c0-94b2-ad7be1b1a5f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:c5da1b12-78e1-5156-bf04-d4e056692e1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:0a5921ef-3329-5710-a45f-43e42d2030b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:a2a106b1-1d8e-59f1-b53e-555aec56cd1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ], "bom-ref": "urn:uuid:09354de7-5b53-5576-9e62-f407a159fb7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 4.3.30.RELEASE-tuxcare.10 of org.springframework:spring-websocket." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.3.30.RELEASE-tuxcare.10" } ] }