{
  "@id": "urn:uuid:2850e21e-7d61-47a5-a7cb-4ce5e689b13b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 49,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@6.2.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@6.2.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T05:10:28.546830+00:00",
      "status_notes": "Vulnerability CVE-2025-41254 does not affect version 6.2.13-tuxcare.3 of org.springframework:spring-websocket. not_affected \u2014 CVE-2025-41254 is NOT present in Spring Framework 6.2.13. The vulnerability allowed attackers to send STOMP messages without proper session establishment, bypassing authentication. The upstream fix (commit c88bfc54c9 by Rossen Stoyanchev) introduced SessionInfo-based session lifecycle management and enforces that CONNECT frames must be processed before any other STOMP commands. This fix was alr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41254"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-41254 is NOT present in Spring Framework 6.2.13. The vulnerability allowed attackers to send STOMP messages without proper session establishment, bypassing authentication. The upstream fix (commit c88bfc54c9 by Rossen Stoyanchev) introduced SessionInfo-based session lifecycle management and enforces that CONNECT frames must be processed before any other STOMP commands. This fix was alr..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@6.2.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@6.2.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41838 is fixed in version 6.2.13-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2026-41838"
      }
    }
  ]
}