{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cd2394d0-5294-585b-b8e8-22e2bfb9a732", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-websocket", "version": "5.2.13.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:1c48a27e-5200-5f5f-8c10-0bb13e4d706f", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1e175900-e98a-5100-adee-1207f34c7f23", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e6ffa9a4-ccb5-543a-9300-8515cd9aa156", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:57d132e7-75be-5313-9903-fe07a647b398", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:073a0d8b-b72a-5797-9587-ef293930d187", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7fd74631-0f6d-5ded-a926-b2837f5731f2", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0e8dd177-627d-5fee-810d-9e1110ff1d36", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6351dcc0-3513-5b7e-822d-7c42dc58a44f", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6668adb0-36db-58bf-afae-ea8d4ac18eb7", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a421a9ca-54e6-5cb8-9253-a511118e31b9", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:441b8f32-a6af-5ee0-a7a9-431c7ae0e672", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e55e64bb-befa-5155-8925-cd92873811ab", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0a0ba448-ab86-5e0a-9ee9-bb21a9a32e78", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3110cf61-0580-5e44-9949-1c546c9515f0", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0f9fd4f9-6cf4-5ec2-921b-84574e9f8d66", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9167bb8e-23d3-5c62-85c5-9824e2d326ef", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0dd37786-d821-510b-8a3e-cad3cf23404b", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7f55e3ec-8ca5-53a3-8a51-04c988c6c6fd", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:60d48497-ddcf-5a36-bf3e-0a15c9d227f9", "id": "CVE-2024-38828", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2e849d9c-1980-5f05-b727-ead04e104708", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4709f423-b1ac-5a4e-a889-6ab52dc4658f", "id": "CVE-2025-41234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:54ecd08a-444c-5fbe-828a-e2116ff18da5", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5c8ec849-9954-5b37-9a2f-e43609d8d5cb", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:67fe8dd5-feea-59f9-88d3-3f4a05941215", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e6d5137c-3d75-5230-b7c4-063a51003ea5", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f271f4a5-a73c-559d-b633-cd6a4b0d4c21", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:40081105-294d-590d-9258-6ba889ad39ca", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c8a14128-ced7-560f-b469-5eab50100e3a", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1982d160-f8b6-5eda-9117-62752f00e73a", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket. not_affected \u2014 Version 5.2.13.RELEASE uses a fundamentally different multipart parsing architecture (Synchronoss NIO library) that does not contain the vulnerable components targeted by CVE-2026-41840. The CVE explicitly lists affected versions starting at 5.3.0+, and the patches fix issues in PartGenerator and MultipartParser classes that do not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:57b6f54b-6e7c-5350-8127-2bb9b0cb8bf1", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:00846221-e484-578c-8555-97c0054367ef", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:50653c60-59c8-51f6-982e-0476704226c0", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:22de005f-0507-59fe-bb31-08f861de0b37", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:87db9ae9-d89b-5942-ade6-e89a267d8156", "id": "CVE-2026-41845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41845 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:38705cff-7a11-5615-9ec0-3f824bdc5129", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ae5d23dc-9593-5262-814b-b159fdb9104e", "id": "CVE-2026-41847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a113b787-4d7c-5e71-9d69-d5727bbeffa2", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:84b36127-68af-5ebe-a9c0-9133857f50b7", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6651b77c-9cfc-5cc3-8e6b-82a92bdccf4d", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4ac79c68-966e-5bf7-a00f-8eb1f9b41447", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:07f4747c-b4a2-5af2-a97b-29b2e0b73cce", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d2b9e8d6-34ac-58e6-b026-0c9a05f04312", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework version 5.2.13.RELEASE-tuxcare.4 is NOT affected by CVE-2026-41853. This version predates the affected version range (5.3.0+), and analysis indicates the vulnerability was likely introduced in changes made in version 5.3.0 or later." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:78c59d0c-6b1c-5c31-8f8d-804931077028", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.2.13.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-websocket@5.2.13.RELEASE-tuxcare.6" } ] }