{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:65e394ba-4c87-5c57-84e4-2e197085c7c3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11", "version": "5.3.30-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:aacff9d6-4c29-5470-bac3-9ca35796133e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.30-tuxcare.11 of org.springframework:spring-websocket and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:7fd8c335-9a5f-52fd-8610-4aaac20c7d59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:6c4f32b1-5658-5bd4-bc71-42ccf76321c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:564f006b-79aa-5208-acfe-8335b01193ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:cb478633-ac42-5564-91c4-25089d711b62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f00f8ea3-d0f4-5c49-beb9-00f2d1933afd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:7f68807c-aa66-5fcb-98a5-2bf687f89051", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:a1108dab-6883-5748-98f0-7b12feba147c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:03d02b3d-07c0-50fa-9411-e34bd4e1329b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:9d84ad5d-6db7-5352-ad09-7519f5a430b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:d5662303-7af4-5088-8bb2-c76a64493f61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:8aa3a7d2-aac1-5459-9b1d-5dce92f7a591", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5bac48c3-6fa6-5583-a621-a336329222d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:21298880-d286-57c3-b78b-8420dac7157d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:36304fdc-b095-5af2-880c-e3efc5057ce5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:c09a9b79-d8d1-5b6a-b7a5-dc12f0bde43f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:b5a3dbb7-ac53-58c2-b67d-8c0cbe952984", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:4275cf21-4fd5-51eb-982c-8f9677fa5ab9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:70dd6af8-fa64-50d2-8251-9826d80a563e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:7fcd77d4-0462-5b91-be2b-3f8167f96afa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:db12292b-9da8-5fe2-a719-cce86a1606e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5b2c490e-ff60-5659-a919-8f2b478ff71f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.30-tuxcare.11 of org.springframework:spring-websocket. already_fixed \u2014 The target repository Spring Framework 5.3.30-tuxcare.3 already contains both fixes for CVE-2026-41840. The identical patches were previously backported by TuxCare as part of CVE-2026-22740 (commits 1a619adbfb and ee9443b0bc, merged May 2026). Both doOnDiscard handlers are present in the current code: PartGenerator.java releases data buffers on discard, and MultipartHttpMessageReader.java delet...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:ff8d4e80-ac1d-5a8d-9f33-c5bd02ba87c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1b7a581d-0745-586f-8a06-4198060d8bfc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:8d637140-c6ce-5bd2-ab26-a766d63376a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:2d73dd26-4117-54f7-b805-a2be02a83413", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:1e05e95e-faa7-5843-a859-0b77054e4f56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:fd48494c-ffda-5e77-b7b8-9e0c02e36eb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:53532380-53f6-57b5-9e4c-c78d5ee809d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:d6297cb1-e364-5c2d-ada0-3e26542248fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:8b1fddb9-d048-5e22-989c-7487714b678c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:aba099a9-abc9-5c6c-803c-343ea05fc557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:714de4ec-71a1-5a12-abde-78bb8104d780", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:bd16f7e1-654d-507d-ab9e-362879d91a97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:38e38a9a-188c-59b0-b466-2c3f159f29a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:76013f10-fd08-548e-b7ba-bab06620b622", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:fdb70847-549b-58a1-bc3d-2af33df21f96", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:e4c759d6-c498-532e-99d2-6ded1cb85740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:da5d2677-2233-572a-8abb-862107bf5fbe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:2500d161-b0fd-51f6-babc-c43b5584390b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:b5d9b20c-c2ea-5ab5-952b-8a7262baf265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:396bdd6b-bb44-570a-8537-44303600ae89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:f313b36e-3de9-5e4d-bb36-4ee93b00f633", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:ec82001b-1f45-5e48-ac70-3e927c2b11fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:95786438-ae2d-518b-93c5-637f48b5728f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:5751917c-a9e2-512a-9b4f-f90cb9f27da3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:31e975fa-0ff1-5255-8e1e-bd728f054cbd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:435b3f0e-d477-59de-b945-cb951399fdbb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:55879ba0-cfca-5300-8ec6-90a5b0c58314", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ], "bom-ref": "urn:uuid:b438016e-922b-5f57-b155-db6e46cde2df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.30-tuxcare.11 of org.springframework:spring-websocket." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.30-tuxcare.11" } ] }