{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e2ce1bb0-ac50-59d5-ae83-1bf86a2a2423", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12", "version": "5.3.37-tuxcare.12", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:74f6de28-a85d-5983-9c60-158741823d08", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.12 of org.springframework:spring-websocket and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:fcb8e321-dd64-5c5d-8649-426130ea59ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:07a92daf-491f-5f17-afcd-5e9c5d2a23cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:50d01e3d-77cc-5610-a830-fe9241eb8b74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:003ebce6-b317-5f5c-86ce-c28edee970c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f8b6f45b-b6de-5d7b-9f49-61771ef2ddb4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:83ceb163-d97b-5607-b991-4e72912c2bdd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:1da00bac-68ad-5c38-b9f6-32a2a94b75c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:0910e505-4414-5b36-9b0f-e89286e2a51c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:1ac8abb0-5879-5d54-9589-262f00ecbd1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:96fd1f39-fcee-5bbd-9aa5-b527ae7e431b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:ee04f721-39db-59e7-8df9-2b959f3dae8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:19a78131-ea21-58d5-b56e-37aae4e1f919", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:faade10e-f644-5a05-baf6-1afc36c5a417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:ada2fcae-d7b0-5d19-ba78-fd94a5871dbc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:810110a7-4c61-5378-99af-256bdea54664", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:1d40a9a1-0e47-5b67-8f7b-b95b07b1f544", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f330ac6e-c893-5df2-b85e-27a31f7fdf60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f6826e10-0bc2-5ec6-9457-5dd47f0dec94", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-websocket. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:468d568e-ef14-54c0-8736-d02a861d5db6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:0b9f26f3-386a-5bd9-bd83-4a65ba76bace", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:2a036f64-de95-5a75-9a5c-354d4ac203e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:533722d0-ddb9-5735-87e6-58bdbfe07767", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:74cb76cb-9c2b-5efa-9571-c4abc45f44ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:b2845df3-9253-56ea-b146-e5c3f608cd59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:152a8670-76b1-563f-9d76-2b146fdb14fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:9d22f7ab-0362-59a2-b426-e2faf0f67dd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:0e3e2453-1c55-569d-8c1f-5c02a1d7da05", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-websocket. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:35c3e590-cfb1-57b4-b7b4-3e9c69a7b07f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:7bfc7a85-201c-598d-ac43-35f4a086dcf1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:cd2ea1ac-8a3d-5881-90e5-2cd4a2538e52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:d24c087f-7b64-52d3-b5fc-8ebd30ad8bc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:a5e2b98d-56f4-5126-a7da-cafd530abd90", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f6a0a40a-b404-5be3-9ea7-0a28e4572c6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:1e5b226b-a394-5bea-86d9-2fdd24cc693d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:58217fc7-52c4-5155-bd3f-2734b62796f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:e0ec86f3-950e-5880-87b8-f0bfef4eeda6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:6ef27d5f-e206-5a9e-b404-1e2c9c745cdd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:8a10f3e7-092d-5007-b747-dac7d9228e22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:2a855fbe-9b55-5425-80b3-3836408e28a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:318ceb88-cf7b-5548-bb32-74a07bb9abcc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:d9e3cd99-2be7-57ee-a00d-c974b2849e76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:3c3af5f0-172a-5454-bd61-2b5ff9b9988c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:61203264-6cc5-5c2a-a1bf-e6f3cf25b2fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:98f85580-43c2-584d-bcea-4a4f879c73b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:a88bc47b-c48c-58cc-ac01-68503f89570d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:97590df0-fc87-58d8-ab0d-955ced65e632", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-websocket." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.3.37-tuxcare.12" } ] }