{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b7a1227d-d4fc-543b-8fe5-915b1763793e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6", "version": "6.1.15-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@6.1.15", "type": "library", "group": "org.springframework", "version": "6.1.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:df314edc-14ff-5074-a138-b30c79988beb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:1052733f-5ed3-5710-b66b-61f2e477e910", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:cc9ab4e3-a7a5-5672-b15e-cbf1d38d3b82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:0671c00b-0763-545b-b1bd-16104541716e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:7a5116fc-2231-5b9f-9ee2-071854353aae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:ddbe363b-ecad-535d-b9f5-4aae4b323fbd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:1e38214d-d168-5d86-a8a8-45155803733b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:a56d5d60-e674-5067-8241-e6f6f6f897dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b0b99860-ab1b-50ba-88bb-5cc1efa58cf7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:0980b86b-3cbc-50ad-90d6-67d525ae046d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:0fb6d946-cba3-58f2-b45c-cc1977bdf2f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:54d4e495-a483-508c-ab4b-efa0f1434bf1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:ff05f11c-ff75-5a73-8382-7a7bace2bc9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:26f19281-d1f2-5c16-9ec3-1f3aa7f29318", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:b422748c-18cc-5085-92ba-58c4ce005fe5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:996fa100-6b04-5a9b-af4d-6f156c326f32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:402140c9-f1f8-58b1-a59a-00028dbfb5a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c47d0deb-2e16-56ef-b257-aa90c34aef0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:6eeac628-0b23-5a41-8787-f6d47d2514e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:260a0cf6-4a3b-55ab-840e-1af8a63c589d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:7f6d1bd4-57fe-5074-ac13-b9e243215bcd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:88a2fcda-9ad1-58d2-8ce3-2c92a88a21e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:e5157d2c-e279-58e7-ac09-e4e44aeef85b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:a14453c5-9075-5930-a0f0-9b6b24629971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:c9af5380-dc32-50fa-86a5-7e37e755bbcf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:13f0e03d-83b7-5c4b-9702-d292c3a8b8ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:6544cf0e-12fd-5576-9075-3dbc7c029c5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:5f6daf8e-fbae-5b1a-9253-78be31cfaa44", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:da2679e6-098a-5196-b8c6-d530c1c15e8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:233adfd2-e6be-5c03-9ba3-590176d2f1dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:8a0021d6-39cb-5fbe-aee9-492c32ba3fd2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:bcab93dd-bc56-5e18-80d7-84a5190e24ff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.15-tuxcare.6 of org.springframework:spring-websocket. Spring Framework 6.1.15 is not affected by CVE-2026-47890 (SSE view fragment stream corruption). The vulnerability exists only in versions 6.2.0+ where the Fragment rendering feature was introduced. Version 6.1.15 lacks the entire Fragment/FragmentsRendering API and associated SSE view rendering code, making it impossible for the vulnerable code path to exist. Git history confirms Fragment support was added between v6.1.15 and v6.2.0.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:745dbbb9-fac2-5f50-98ce-4ff42eb6ca3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:f0cbd2ed-3e2d-546c-9b56-fb7f4daf2101", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:0bf83553-9e9c-5e1f-bc36-100cf4e5a976", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:ea68aecd-d55f-51b4-a4b0-c2099b9122a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:72f1e32e-1560-5415-bbec-8d0a73a9b3f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:4798c846-afb0-5529-864c-95a9a35b436b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:814013da-ef96-5624-a1ed-381b8625a4b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:9ae8ecba-fe1c-5ccd-8c78-236795a0273c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ], "bom-ref": "urn:uuid:bc5de601-aa8d-5600-a9f3-2e9e54e71f19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.15-tuxcare.6 of org.springframework:spring-websocket." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.15-tuxcare.6" } ] }