{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:723e7a69-3d22-5c61-875f-3e6db78c1769", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-websocket", "version": "4.2.9.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:1568d2ae-1765-55f7-8618-893cf7bfb42e", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f3563d9d-5c8c-5d94-aed6-54d9808e727d", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:89b74b7c-4207-584a-8565-c1e0749ccc9e", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:22d73c94-982d-5b96-9814-9c260586ee41", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:350c1baf-45ff-5d95-9cbc-efa077a34bc5", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c4d3ea6c-b4b7-5cdf-b42a-49f8c22d56b1", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:39e2b6f4-c69f-5fea-a7ec-1366697a8889", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:752df0df-917c-5260-8e1e-8fcde1f97a1f", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:cb993ae3-5ca1-56cc-bddc-527eabb43c85", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a48c8131-e260-5056-bdb5-5e79eb43eed8", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fd5dc755-b240-54bb-9e79-3504b9b96153", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:38ddaba4-a386-59af-b3a8-2ded9fc11af5", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bd620fd4-168b-542b-9373-387336b3d387", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bb96ac9e-86ad-582f-bcde-3998fe0a386d", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7a98cd9a-394f-5a2f-8c1a-2457f19f8177", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dd55e55d-1133-5b25-85f7-07b6b4814fd5", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3704c95d-3155-5b0c-9daf-af626de73287", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:989e0b74-751d-58b9-8acb-df88a10e8bed", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a356c2bb-59d1-5cbf-acc4-11e0967266b8", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f4edd9ca-272d-56a5-8a4f-e4cb03d22e05", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:da27652a-a146-5e2a-9139-1433e4302fd3", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:07c02f5c-ec34-5615-b024-df57eca07186", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8f2b8ea2-10a5-5522-8f45-57144c98bae2", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1d45f549-2075-5ad2-93e5-516d4e1243e3", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:43881db4-b6b6-5f3c-8b65-7d4938b0f7a4", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e74ebaaa-d78b-504a-af94-e685edd5cf90", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:85a8928c-3a1a-585a-bf48-c4a9477e27cc", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:99a055ab-1b13-53cb-838d-cf7e2251c103", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e6b53cea-f89c-5815-9bdc-e9b173e7aa6e", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f1503cc0-0e30-51ff-8d65-709c99d72333", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8930ee64-9478-5cbf-85eb-649e1f6a59f3", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b2386c8e-51f5-5585-9a8f-02beb5fbb31c", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4592bfc6-8d27-56de-9f8f-db159e3bfc7b", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:276cefe8-1f13-550c-9a6c-86fee0c4bd05", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dc6c1869-d138-574c-bbf4-a3a91fe4255d", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fe6421e8-a3cc-5fb1-bf8c-b1491b9922f2", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:efceee4f-9202-5fef-ae53-2c6c2d9ae979", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6963bc5e-a24c-5f36-8454-9d3f25028f2a", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:299c1d2a-d4e1-58c9-9463-84565d480a1d", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c5d265d8-e9f8-57a6-8f70-440f6fceea51", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dedb75af-6f9f-52b2-acfa-4af1fd2e4a87", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e813527a-24f2-5d55-a504-6e977faf11d0", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:47ac434d-2bd5-51b9-ad1e-4dbdee45183a", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:14eb57e3-3732-5113-84fc-84170ed9cac9", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:39edef23-73bf-5aff-a54f-90f7adf1ae43", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:71150fca-8d40-5c58-b62d-20803640f0be", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-websocket." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-websocket@4.2.9.RELEASE-tuxcare.6" } ] }