{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:eeb9e4d2-8b0f-5311-ac1a-8ac7e58f1279", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6", "version": "6.1.19-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:ef81a426-9de0-5c89-9827-4efd41911c1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:380b295a-e288-56fd-a890-c638266f9d4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:8d429973-6ba9-53f0-b002-1bb17353f453", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:980733ea-76d8-55c3-974a-7280ce41553d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:56a1da92-bdc2-5783-84f6-fbe31126202c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:380b0398-59f4-5994-8c20-3e808b0ab1b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:8ffa949c-dba6-520b-a209-fba926cdb856", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:9e5bb3db-ad5c-514a-8e2c-cf015a758729", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:f4b15992-29e6-5075-a830-8e2860164055", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:94946201-04c7-5597-9046-94562e20097d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:feecd27c-2fd3-5984-bb7b-1c7fcde0211b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:1e1bd149-1d90-5d96-b20b-fc5781733987", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:a9f5e76b-6c1b-565a-8249-54ea28184943", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:7a25f61b-d4e9-58ad-ad1c-f50ee840a6fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:a5cc24fc-ac3b-5dba-b0f4-897219ad402e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:5696c7f8-a30d-5084-b418-1c373e75f626", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:53075506-14c9-5f5e-bdee-a34b4ffbd6ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:a86ed0ad-37bf-5a61-9855-a0fa9e2c45e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:7f92af0f-62ad-5d64-9d4a-11c1dd78688a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:4719ef55-79bd-5971-b5f0-6fbad2811c95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:01071c1a-8e91-5043-9b0e-760f8e34c4c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:1f1e0ee4-9fac-5f70-80ad-53ef1cbf4881", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:2c1a6f28-ce55-5ed6-93d6-4993d94a7ab0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:609e9e17-668d-56b4-8d2f-2440315271c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:7fa35cb1-7f55-57cb-9afa-98f8b02d66dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:7e28f250-d5b2-5bbe-a042-d947a40e8912", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:9cda9961-a453-5d10-b09b-2178a8efd08c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:cde47a85-d6d8-5779-8c8e-9b6f66dd1956", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:c9414776-f63b-5083-93d3-8e271326564a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:588829ec-27c5-5a87-aee9-b285eddde8e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:8a7b1a9d-e5bd-5e8b-96b3-f888bc71fa6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:659676da-a70c-5ada-ab3c-62542ce2f8cb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.19-tuxcare.6 of org.springframework:spring-websocket. Spring Framework 6.1.19 is not affected by CVE-2026-47890. The vulnerability targets SSE (Server-Sent Events) Fragment rendering, a feature introduced in version 6.2.0 (August 2024). Version 6.1.19 predates this feature entirely. The CVE explicitly lists affected versions as 6.2.0-6.2.19 and 7.0.0-7.0.8, confirming 6.1.x is outside the affected range. The vulnerable code paths (ViewResolutionResultHandler fragment formatting and ResponseBodyEmitterReturnValueHandler getFragmentContent method) do not exist in the target codebase.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:26bfdf09-d535-5521-b1c2-3fba78733d11", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:2c165c64-b3ea-5594-8358-38842cdb91c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:09b07f72-7f42-5777-b7b3-d9cc9fdc20f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:ca067987-87b1-5c10-b774-31b00fed6473", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:69748695-b4f0-53a7-b43e-2311007d3654", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:ed05f60d-c47c-55e5-8712-0ad66ef9d9c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:bda6df63-b71d-5874-b39c-f8c5e3bead51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:03ba0222-1e11-57fe-91c7-c8eeb7d112f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:d88d15d0-de5f-5689-b754-a95ee5dcdfa6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-websocket." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-websocket@6.1.19-tuxcare.6" } ] }