{
  "@id": "urn:uuid:6ab09414-cd1f-4864-84e9-fb70f5d585c0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 50,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T15:11:52.923350+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T05:10:28.546830+00:00",
      "status_notes": "Vulnerability CVE-2025-41254 does not affect version 6.2.14-tuxcare.2 of org.springframework:spring-websocket. not_affected \u2014 CVE-2025-41254 is NOT present in Spring Framework 6.2.14. The vulnerability allows attackers to send unauthorized STOMP messages by bypassing session establishment. The upstream Spring Framework 6.2.14 release already contains the complete fix (commit c88bfc54c92 by rossen.stoyanchev@broadcom.com, \"Refactor state management in StompSubProtocolHandler\"), which enforces CONNECT-before-messaging b...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41254"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-41254 is NOT present in Spring Framework 6.2.14. The vulnerability allows attackers to send unauthorized STOMP messages by bypassing session establishment. The upstream Spring Framework 6.2.14 release already contains the complete fix (commit c88bfc54c92 by rossen.stoyanchev@broadcom.com, \"Refactor state management in StompSubProtocolHandler\"), which enforces CONNECT-before-messaging b..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@6.2.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@6.2.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T12:17:00.073111+00:00",
      "status_notes": "Vulnerability CVE-2026-41838 affects version 6.2.14-tuxcare.2 of org.springframework:spring-websocket, and is fixed in 6.2.14-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-41838"
      },
      "action_statement": "Vulnerability CVE-2026-41838 affects version 6.2.14-tuxcare.2 of org.springframework:spring-websocket, and is fixed in 6.2.14-tuxcare.3."
    }
  ]
}