{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2a70bc67-7c97-505a-a523-05480f7b46f0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2", "version": "5.2.10.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.10.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9994f287-8d11-5e48-a6aa-096965fd0b16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dbb9137b-eb2e-5d9f-a1e3-58256f9604c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:eacdcaff-0326-5922-ae8a-de94322cf221", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d1f0576f-ba52-582d-8a65-97e8a8c6858a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:916458c8-1129-55f2-9d9c-552e849d3dfe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f3db0691-93bb-57c2-8597-3a65c0a441e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5272c9bf-c66c-5867-a41e-7858eb9a55cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2ac35fca-a1cf-5130-a9b4-21e4f162be55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:759e1574-ec98-515c-bf6a-7b0f68ecc0d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:66dd4173-fc8d-5a1c-a257-ffd989059d75", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9fca37a6-9c14-5698-a487-031870a93216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ecf71fde-6e1e-5bdc-ab52-7052945ff9c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0ec8a54f-0476-5efd-92ee-4d82a29d87cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7347341d-4322-53ed-a615-41c8ce6a58df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8cbb633f-06e8-5e0c-acd0-168d1d5d00ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bec20c3f-3fff-5bea-ba76-623ad8fc41d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d7d0d5b9-b64b-5b95-b8d1-511f79956080", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ca27e2c4-18e2-54cf-88eb-ce6c81144085", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b81ef75e-352b-5f47-b315-ae9be6204f79", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket. not_affected \u2014 Version 5.2.10.RELEASE does not contain the vulnerable code pattern described in CVE-2024-38820. This CVE specifically affects the fix for CVE-2022-22968, which introduced case-insensitive field matching using String.toLowerCase() without a Locale parameter. The target version uses case-sensitive matching and does not call toLowerCase() in its DataBinder field validation logic. Therefore, the l...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:12347e71-6994-549c-a5fd-4d3042f22166", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4d9dfc4c-f905-573b-b129-8fa72b81af2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f6c4656b-11bf-56ef-ac53-fc439db2cbac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a7b20eb7-e7d7-55a2-b2e9-fce3eca24486", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7d1030a8-c2a5-541c-9456-396715677db1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:642e8ec5-8dfb-5aea-ab85-fdb19e42bb18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b5db4a18-c273-5029-ac9f-673844842d58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:eb6633ec-4c7f-5965-b309-502e6c194c88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e99d85d3-c632-5561-8e1a-5e95f8d3671f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2fbadd68-94ec-5739-974f-8e27c8d8d1d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:674f2f8a-b91d-5a16-ad3b-71bb30261ad5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a42606db-1377-56d0-94e1-9db7084f27b8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket. not_affected \u2014 Version 5.2.10.RELEASE is not affected by CVE-2026-41840. The vulnerability targets the PartGenerator/MultipartParser multipart parsing implementation introduced in Spring Framework 5.3.0. Version 5.2.10 (released October 2020, before 5.3.0) uses a completely different Synchronoss-based multipart parsing architecture that does not have the vulnerable BodyToken buffering mechanism. The vulnerabl...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d7f1deaf-330b-5ac8-b080-dd08963d5606", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3c8d899f-9e3e-5657-9eee-0cbb0638e395", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1143d02a-e73a-572a-8aee-61431257a683", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d40fb58b-cd49-5cbf-a719-bbaf520e0d90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fbf87376-ed8b-5e5a-be3e-e74c8865831a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:36ed420c-7b19-5fac-b70d-b79cff3de14e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2e5cd1d6-1583-5565-80ce-ebe701a8dc51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:559be7cd-6966-5cdc-8541-c0b2acdd70c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8441d570-4617-5a7c-b01d-d8c99a52a93d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a9fefce3-68de-51c7-b08f-9035356b9c58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:87822138-b0a5-5d73-adad-830a3231d824", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e97fb9e6-163b-5e45-934f-a1cddc658b5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2274af4f-4bc6-5d26-a15e-82c384979c26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1ed46d82-fff5-5063-923b-6b912c72900b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:86cbd2e7-4168-53c0-8788-89138f921866", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a8e7918c-a3b3-57e2-9fa0-3ab2e96df1af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c4c2ff28-bfff-5f8b-9ff2-26513f553771", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b6a2a72a-2cba-50a3-9464-f081306a5008", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4a687363-d1af-53c5-bcf0-a6d1ac0e9105", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6295b4ae-b287-5b14-8a84-de5963b22775", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket. Spring Framework 5.2.10.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) view fragments, a feature introduced in Spring Framework 6.2.0+. Version 5.2.10.RELEASE predates this feature entirely - no Fragment class, FragmentsRendering, SseEventFormatter, or SSE fragment formatting code exists in this version. The affected code paths were never present in the 5.2.x release line.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0d38a9b4-a35d-52b5-ba84-450b366f182d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:db0b6520-1a46-5993-b2e0-e0f70fc49c75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7bebd946-0357-5c59-b781-78b30ca0c587", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:91a8ec64-576a-5a9f-b337-08d7132f7a4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d13fbb11-3719-5ad8-969c-1f3869fb4172", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:85ed0a72-706f-57a6-a4ab-9f4e0fae2dd1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cc766589-acee-55c1-ad31-79c8a833f3ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a2d1619c-3d9e-5b55-be5a-787c3ac96a12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-websocket." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.10.RELEASE-tuxcare.2" } ] }