{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b538afc0-e3e5-5c38-892b-feec2dc9e6cd", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11", "version": "6.0.16-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:0bc7c015-49c4-5be3-b354-a96e78e60e29", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:0a6fa4de-5392-59c2-bba3-eedb07079ed8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:a36ced45-9b85-5022-b1d5-b9e36b4986dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:03de3d9c-655a-54f5-8c80-1f2ddca7bf02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:32c6c8a8-50f8-5dca-b3f9-8c231cb4f57c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:2754ba01-6de4-5e42-b637-98f8802fe247", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:4d511cd2-25d6-583c-bd17-09804b9eff2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e3f996b9-9c86-5409-8400-1a81035a0e63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:2235ed65-52b7-5eb7-828d-7d9202061240", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:bbecedde-30d7-5312-9af8-353928f27a01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:635d6a53-249b-5af2-88c3-377d3f69a77c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:3329b960-daa8-5c64-b615-c3cdedbf96e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:79238d70-3f44-5887-8761-1d7962f9af95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:a61b9ebb-c677-570b-8c66-c1480c9279a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:fb132d70-1673-550c-b90c-2bf6049df326", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:5fc18820-7b0f-5838-82c3-d8daacfac184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:b432ccb3-84a7-5d08-b1c4-aa5d1a1f54af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:b2dbb704-d050-5ee7-b089-8b77b1640afc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:eeb67b33-51ff-5873-836c-fa5fda08cc53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:893c9a08-f616-557c-a115-cbc8b9f0c508", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:53a1759f-8b6a-50ed-aeaf-06dac2386d3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:64456214-c09a-5fd0-a186-ef54288dee7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:f47cfc07-cfde-56f3-8219-115453c3bec9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:fc4ff911-00cd-59e2-a583-1595cacfe2b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:ff7ae616-9bb0-578f-983e-b7bf56d76bd4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:4793e89d-9f19-5e0c-9c05-5e3a261bad08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:859b5b43-613a-5536-9078-2367ad5daa0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:f1e3ce59-a9ee-5665-b867-df88919736a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:31713da3-539f-5f85-9568-1b92209515db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:dd9898ba-3f0c-54e9-8a21-5a84c63da56f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:045104cf-f205-5c5d-9a43-807f7d1ef737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:8da176c4-bdee-5340-865d-befd3c5820ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:b34ea50b-103e-56e7-881b-48822826f422", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:cd63f037-3097-5c52-afcc-95d16f853459", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d6960380-563c-55e6-9255-036ff7ac5e76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:ea2f66dc-cd17-58dc-a2b5-8cbb3c2b4819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:111fd540-a636-5ddc-bf73-810a24b91e36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:3f6977a0-5f02-59a7-ab5c-513645a90dff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.11 of org.springframework:spring-websocket. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:fd6dc8a3-9a69-5506-937b-c63bad285d52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:9ffcbd6d-136b-52cc-ae68-b8df8cc7ecc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:364037a9-0422-5c66-b6ea-538f5a4d869d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:c0c6f9d9-dda3-5f90-a879-ff330836093a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:53435dc4-1dba-5276-8cef-1bb7d346ae1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:27081d22-98bd-56fa-8ff7-757f2b438580", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:aaf2ecb6-2fe8-5651-a81f-5e452a265c9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:a6c44fbf-7e4e-5e39-baf4-2032683c06b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:befcc189-0559-5836-a116-f0478f7abeb4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-websocket." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.0.16-tuxcare.11" } ] }