{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cb530d41-d888-5a7a-85ea-a76c0ff99275", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "name": "spring-websocket", "version": "5.2.13.RELEASE-tuxcare.1", "purl": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:137577f7-07d5-5b00-abfb-e537eec3927c", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c3898ba1-ecae-5fcb-ba61-3f171e080f99", "id": "CVE-2021-22060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5049f61d-1a98-59a3-8584-07b17f17e411", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a6b2180f-4766-5b77-881c-55028f0f71ff", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:5c5d8dc0-75aa-594a-8bde-a9ecf5854b8e", "id": "CVE-2022-22950", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a562a552-8655-507b-92ef-d90bdc9fd86b", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d95b9b74-b6a1-5bbe-8429-9bd29f40eb70", "id": "CVE-2022-22968", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:cfa10a5d-6982-5246-928a-c0bef987928b", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:13c5322e-96d3-5024-ad98-30cd1d29f6d4", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:eb082365-9260-5859-9db3-7887a696c538", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:d0ca98a6-f6e9-58f0-9c32-47ef4d0aa049", "id": "CVE-2023-20863", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8e311c85-95f1-5f70-9378-1bdc6abd03b6", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:533f8a9f-3d14-5e35-90f2-5507317dfc49", "id": "CVE-2024-22259", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:52eee50f-2e65-56ee-b5ba-0837cf1d34dc", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:9837005f-b086-56b8-9f46-146102d974a9", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b24ad2ff-f9ff-510c-9c4e-aec3470e2833", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:aa65d1fa-f5c5-5410-8540-0e9d05906c10", "id": "CVE-2024-38819", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0d79a26e-86e5-5057-adc8-f1733808a480", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:589345bf-b87d-528e-923c-f5705f84fe37", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:76f34fd0-bf7a-5855-867c-39ddecdd8086", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0442f86e-7240-5c00-acdf-5fd619d6ab36", "id": "CVE-2025-41234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:282536a7-3506-556a-88d5-654b8d5eb408", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6e7a3820-b127-5a5b-8d0a-0978e98ab7fe", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e7046066-6146-55eb-92f3-442dc5194fa2", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:010198e6-0fff-5740-9e14-4789d30fba17", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0cb8fe4c-30af-53ca-8139-68c543b2bde3", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c6ee5300-4797-5187-bfa2-6c242256881a", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:551c725b-38c2-5541-a2fa-01c110ade38f", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:a3de6b85-df12-5cd8-b8ab-2b443a412830", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2812010f-57b7-5749-915c-951ef1d537ad", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:8f259c2b-43a4-536a-b8ff-ebb9f234f092", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:824bba0e-7400-5da9-b8cd-169bb86d23bb", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e4f6d3ec-6141-5479-b2d7-a4b4ddebee3e", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:f5ace0c0-0680-5c70-88d5-38c6ee5842ca", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:28de4768-f670-50a5-8837-888118b0652f", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:0a240c01-0967-5f30-8a9f-4ed3b1c5aae6", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:bfce125b-d604-581f-a208-4e57a56aefe4", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6b148e4f-b7b8-5560-93e4-bc4ede193caa", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e3d3e62d-63b7-52f1-98c9-73e7caf9808f", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:afae40e2-9f30-5f18-8852-e39ededc59b4", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6770c386-90f8-57fa-bbcb-ee16b8245346", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b5c8e0aa-d779-569b-aa28-36049a27486d", "id": "CVE-2026-41853", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:db008d5c-385b-583a-b44d-b10309378aa4", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.2.13.RELEASE-tuxcare.1 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.1" } ] }