{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a0b402e7-3d3a-5e89-aafe-7cf7609aa459", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10", "version": "6.0.16-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f722d914-31bb-565a-b817-88bb5ed75892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f11e22e7-020e-5c9d-b8f7-f31c23a29d49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b26fc13c-c0f2-521b-9c4b-5ad85527a47d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:00be236e-a7ee-5fd0-bb0f-0d0b4a3011bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d6e59db4-04ef-59ea-87ca-474767e6db99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:a6379d94-8ee0-503b-996a-3f9060281e0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:5213d7b1-4875-5271-84e4-a25f1e6aba47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2e9130de-8508-516d-99fb-3e9bb18609d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:adac3553-d6b5-5b34-bd1b-de760185d609", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:96ae71d3-c798-59da-99a5-bd92f024c9a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:40c761ef-c0af-5db9-9eb8-c6dba3acde0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2d1aeb35-bd66-5ae9-bcfb-070da3c231f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c3b8a3dd-d1fb-551d-bae3-709d240eb51f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:dc52ece4-c16f-5b0e-8118-1c0f42ca7af4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e926c26d-cc94-5f78-8dbf-8ca7eef6faba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:72e7440b-a19b-5cf6-b83b-b44ec9daa8bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9f8db2d5-6874-5ca9-9226-5590044327c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:13510395-ec1c-5cc6-8384-15e9683e0ad1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:370ffee5-99c4-57dc-abe7-23b44d22a108", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:3afb5545-6623-501c-b024-2d44151e8cd3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:376f01f7-feaa-5076-b292-f2853f487a45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:10fbf80c-b9c7-56b2-8712-d6103ac655f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:940615de-c210-54e6-953a-d64eacbddb5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e39c36a8-631b-52e2-a973-b97d51874972", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:a0460195-a3a2-5c0c-8b45-fa2babe6ef14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:79fa2f78-6e83-5308-83c5-9c7635b94524", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:98f81afd-8ef9-5950-8281-833161fb6638", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:589951a0-2329-5898-80a7-3a87e97902ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9a353749-d979-5d65-be47-8ecbd5152358", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b92284cd-3ba2-56d4-ac57-eb88da702215", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:37611a87-a77d-5ce0-9c64-9a21afe78090", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1a640e8d-b5cc-5ac5-b88b-0b778fc36e7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f614acca-ab69-58ef-9540-1a424b7a71c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:dec2a91c-6464-5c50-adc1-c6a7b91e47a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:bc9eef83-11be-5d8a-b8d6-010e38a4a59f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b6c974c1-801d-52bb-95cd-2bd9a28e231a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:51be9bed-163e-56a2-b060-e01823e1f0d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:aeb53305-e860-54d9-9913-a9ce22a6333b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-websocket. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e14ad3f0-fefd-51d9-9003-c9ed59283015", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b966674c-3294-526e-b9f5-9055ff014bee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:767cc807-c701-52d2-91f5-0eb8b19337a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:cb7381cf-46de-51ad-b1ae-ddccace2abef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c6011115-d6fc-5fb8-a58d-276e6a57d86b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:cb118135-858b-53fd-add5-84a8f32c9c55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:efc44b4e-ab4b-54af-bd98-e71a54208d91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ddaad1b7-85d5-5b1f-ae1d-ac85bbd81327", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:86c6bd13-5a9a-50d7-b0f7-540178a22ee1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-websocket." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.10" } ] }