Search for packages
| purl | pkg:maven/org.springframework/spring-websocket@4.3.6.RELEASE |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2018-11040
|
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-1257
|
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-7fch-4f2f-jcgm
Aliases: CVE-2025-41254 |
Spring Framework STOMP over WebSocket applications may allow attackers to send unauthorized messages STOMP over WebSocket applications may be vulnerable … | There are no reported fixed by versions. |
|
GHSA-q723-847q-5g8g
Aliases: CVE-2026-41838 |
Spring Framework Predictable Session ID in WebSocket Module IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, … |
Not vulnerable Not vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2015-0201
|
The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to … |