Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.springframework:spring-websocket

2 known vulnerabilities (2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
2 · 2 medium
Registry
Maven Central

Advisories 2

  • CVE-2026-41838Medium 4.8

    Spring Framework Predictable Session ID in WebSocket Module

    Affected: from 7.0.0, fixed in 7.0.8; from 6.2.0, fixed in 6.2.19; from 6.1.0, through 6.1.27; through 5.3.48.

  • CVE-2025-41254Medium 4.3

    Spring Framework STOMP CSRF Vulnerability

    Affected: from 6.2.0, fixed in 6.2.12; from 6.1.0, through 6.1.21; from 6.0.0, through 6.0.23; through 5.3.39.