{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1651bce1-a8a8-5ce4-9da1-94f24e7eb150", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-websocket", "purl": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6", "version": "5.1.20.RELEASE-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a2e7b88c-6c83-50cd-be54-94dee67377ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1d0a5974-9cb7-5f47-9323-c19103783c6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5421 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:971504e3-98cc-5701-8646-4c38f8019b94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:5ec8f2c3-7741-59fc-9ef4-ae0ea1d78143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22118 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a6088e00-4efa-58df-b90e-ae23e88a4177", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a25643dc-a5ad-5330-b22d-45f7a0599048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9908ba23-af10-5832-a097-71c168ea62be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ff6192dc-26d5-55c7-b4d9-7e1a44cda8c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c762382b-4e99-5bcf-8e33-fe31781e5290", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:23107326-b183-54e4-a6bb-22de808acb3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1d9e1a2c-f60e-57a8-9777-afa9a88aabc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:5f7e9471-622c-55a8-8568-9e05d860a4c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:15783bc4-d6bd-57ac-9363-5996b7f52d9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:2c5b8f2f-788b-5c12-88c8-9d8886fd72e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:cd246426-f5bc-5717-b8bd-833f003203d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c70b0c3a-4c83-5317-8a23-46f37fbee8c1", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-websocket 5.1.20.RELEASE-tuxcare.6." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:cdf31d58-bbbc-5c01-bae5-2e194379e07e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7800cf34-41ed-5c2d-afc4-b0718d6ea1f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:71203440-743e-5f02-a414-45512061f0b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a329c249-4934-501a-8344-f90e82e4264f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:add763cd-6a99-567b-bea2-f53ac6fef384", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a92a9796-d639-5f8e-9e8b-fe688a42ffae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7a64dd7b-2ba7-5594-a7d7-67ff45cfb0f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:2220b332-4778-519e-8226-73f78748f4c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c0858234-d5f2-55c0-ac20-17e4822586f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:925510df-2439-5226-9ddc-b06da0abc62f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:30cd5c0c-4d37-5f4b-be3c-33874b806954", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:aa138c0a-fb68-5c70-aa10-5e3484361cfb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b020d6c6-457c-5eb9-964f-f9e1d45b4dd0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:5700daf3-7673-5d48-b4dc-e11c2e7547e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:2429c1e5-41a4-5d96-b4ea-0ee6122b395d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library).", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:6c01f6d4-e62e-5c8f-9a4f-50ac45bc6b9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7f5aa3c0-067f-58c6-abdf-c4e510bb7e11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c6b0e097-72f7-53c1-84e3-de0228c6b7de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1c404569-3357-5004-843f-57563b2e5eaa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:59bd44c5-2ffe-50df-83de-73bbc99f9c30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9b87d0ff-fbb2-583c-aa87-00220f62edc8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a26b8a5e-cde9-5bad-92ca-20e2e35ac0d4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket. Spring Framework 5.1.20.RELEASE is outside the CVE-2026-41847 affected range of 5.3.0 through 5.3.48 and predates the vulnerable RouterFunctionDsl.filter API." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3bd3dce5-1bca-5c27-a7e0-fded05871ee6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b553983b-cc9b-59eb-a242-5c2b41281e7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:40ba3187-8400-5b86-9c9d-70fba2a48aab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:03ce6bc4-d093-5fdd-818f-e05fecc8d1f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:31efec96-ddad-577c-b15f-492a633986e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e21ba9d0-3e2c-559f-876d-64de5315fd26", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:76ee40d1-683f-5180-bdd0-4b0d2b1aa4cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:2ea99441-8562-510e-ac1f-4c593541243f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:98095cfa-439e-578f-b09d-ca24ec2d732b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:da2c5f71-6024-5904-9449-15d8075964b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:483d15d2-90cf-5689-9d22-ccacb51438e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a043bd20-206e-5467-a6c9-fc1f690532f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:63bb7cb0-e933-5a36-bdec-90c1ab56b0af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:888b09ff-6dde-557e-990f-247fbf8fa13f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:03a1999f-7695-564a-914f-6614f034bb61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:8f9da130-9ec2-5caf-8ac3-0066a6a10ada", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ad72bbd3-7782-5504-8065-087ba5f128ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3a4aa756-cb58-5b9e-b1bc-b0dec24d4818", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.1.20.RELEASE-tuxcare.6 of org.springframework:spring-websocket." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.1.20.RELEASE-tuxcare.6" } ] }