{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d12de773-f605-515a-8dff-21902a4b6c5f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6", "version": "6.0.11-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@6.0.11", "type": "library", "group": "org.springframework", "version": "6.0.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f022d272-451e-53ce-9be9-178803d46f8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:e399f36e-bcc7-5cb6-bbee-9cdc3754ad66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:e5e0fd10-04b8-5326-89ae-86b73b287b86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:4d6efbf7-a58d-570f-8a93-3d7e4e09cb30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:23dd663c-a22b-5ebc-9af1-5782645ea824", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ae28da5b-dd0d-5e06-baf0-8da30c001fa4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:c295be80-c885-5096-90ba-941fe2bbfa19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ab5f6713-59f1-5ae6-9fb1-40a6769b0075", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:257fdbb0-352c-5e7c-ba78-86205db6c3cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:4aa19c82-b2d8-58f9-8cd2-d6ec839eb544", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:2596635a-0b4e-50d1-b25a-121bd01d2ff3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:452d6c7f-0ca1-593b-ab33-5e1c1fad7816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:cf592245-b2e3-502e-9ede-56aa2afa8460", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:3a5ce23d-8a64-5129-9042-b9dfe0c9c00e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:e843138e-0dbe-500d-b57d-7d858652d00c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:878d06eb-2f7e-5c1d-aba5-efe7fffffdfb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:6e1ea83b-cb76-5024-b9cb-f30f937e43d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:2b45e3f2-9f54-5363-9d53-b05400d5b3a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a26520cb-9148-5c86-bdd3-e264a317ebf7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:aab6aaa8-c9a3-587a-b326-0bc2e740935a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:61cd6191-0e54-53ea-b374-506a342c0859", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:2fa98c47-8f31-5fec-a46b-6c2259dcbaa0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:069db880-5102-51dc-82e5-f40f32705289", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:92bcf386-546a-526e-9a37-276626ff2785", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:87cd0b7d-df74-54e9-b053-0edfe4273ac3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:bdc48582-bc16-5e97-97ed-28dca7802e4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:fb73457e-851b-5fc8-8780-48126f2285ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ee0fc7e1-c534-5b28-8ead-8beb7080a71c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:17b8b040-d882-51a8-bd2a-fa056dc8e188", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ee0486c0-4dea-5c87-befb-a47ad64d8c2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f68d91b2-5e1d-56fd-b077-f57cc4f19b7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:8f4ee92a-d741-52e2-84b7-cf753ea7b9e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:787ae1b8-76f6-568f-972e-c7f1000012b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f4de963c-93d7-5f7b-8ef1-1565b96c13e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f92d333b-8d67-51df-a99b-87e3520410e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:bbcb2906-9b81-5713-90d4-fc9db2585661", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:6fa61945-6a0f-5352-9c74-45ae0d190fcd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:28a751ac-640f-529e-9341-db24e4f73af5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ebcb8415-6d9f-52d6-91cf-ff64ea4621ca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.11-tuxcare.6 of org.springframework:spring-websocket. Spring Framework 6.0.11 is not affected by CVE-2026-47890. The vulnerable SSE (Server-Sent Events) view fragment rendering feature was introduced in version 6.2.0-M7, which postdates the target version 6.0.11. The Fragment class and related SSE fragment escaping code do not exist in this version, making the vulnerability impossible to manifest.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:96ccf1af-5e61-5081-9274-7c04bb601aee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:c579ae11-09d4-5915-ad88-3cbea1bf840f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d2a07a75-d804-5872-8b63-be311fad9bb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:2abb0820-f710-5d73-a84e-ee1a43e5ed9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:985972a4-e3c6-540c-bd52-8ba7d7d56ec3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:2e66971b-01ca-5029-b9ed-da22cd0b23b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ce322803-02ab-5172-b840-97f3df685ed4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ac157950-c85b-5c00-9938-7f7b55808bc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:2030481f-3f6c-5586-8614-34c361f928a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-websocket." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.11-tuxcare.6" } ] }