Security Bulletin: Vulnerability in Spring-core affects IBM Netezza Appliance

Summary The Spring-core package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2026-41838 Vulnerability Details CVEID:CVE-2026-41838 DESCRIPTION: IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which...

org.springframework.integration:spring-integration-websocket (4.3.22.release) potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.26.release)

org.springframework:spring-websocket MAVEN version 4.3.26.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.springframework.integration:spring-integration-websocket 4.3.22.release...

com.github.demon214:dstudio.web (>=0.0.1, <=1.0.5), com.github.tianjing:tgtools.activiti.explorer (>=5.22.0.14, <=5.22.0.16) +11 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.1.5.release)

org.springframework:spring-websocket MAVEN version 4.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.github.demon214:dstudio.web =0.0.1, =5.22.0.14, =5.22.0.6, =1.0.4, =2.2.1.8...

ch.rasc:wampspring (1.0.0) potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.0.0.release)

org.springframework:spring-websocket MAVEN version 4.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - ch.rasc:wampspring 1.0.0 Source cves: CVE-2026-41838 Source advisory:...

org.spamjs:mangolite (0.0.0), org.springframework.boot:spring-boot-starter-websocket (>=1.1.6.release, <=1.1.8.release) potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.0.7.release)

org.springframework:spring-websocket MAVEN version 4.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.spamjs:mangolite 0.0.0 -...

org.springframework.boot:spring-boot-starter-websocket (>=1.1.9.release, <=1.1.10.release) potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.0.8.release)

org.springframework:spring-websocket MAVEN version 4.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.springframework.boot:spring-boot-starter-websocket =1.1.9.release,...

org.springframework.boot:spring-boot-starter-websocket (>=1.1.11.release, <=1.1.12.release) potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.0.9.release)

org.springframework:spring-websocket MAVEN version 4.0.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.springframework.boot:spring-boot-starter-websocket =1.1.11.release,...

org.lightadmin:light-logging-configurer (1.0.0.rc1) potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.1.0.release)

org.springframework:spring-websocket MAVEN version 4.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.lightadmin:light-logging-configurer 1.0.0.rc1 Source cves: CVE-2026-41838...

org.grooscript.conversion:org.grooscript.conversion.gradle.plugin (0.9), org.grooscript:grooscript-gradle-plugin (0.9) +11 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.1.3.release)

org.springframework:spring-websocket MAVEN version 4.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.grooscript.conversion:org.grooscript.conversion.gradle.plugin 0.9 -...

com.ahome-it:ahome-tooling-server-core (>=1.0.94-release, <=1.0.108-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.100-release, <=1.0.107-release) +11 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.1.7.release)

org.springframework:spring-websocket MAVEN version 4.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.0.94-release, =1.0.100-release,...

com.ahome-it:ahome-tooling-server-core (1.0.109-release), com.ahome-it:ahome-tooling-server-hazelcast (1.0.109-release) +8 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.2.0.release)

org.springframework:spring-websocket MAVEN version 4.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.ahome-it:ahome-tooling-server-core 1.0.109-release -...

org.ops4j.pax.web.samples:war-vaadin08-spring (>=9.0.11, <=10.1.1), org.springframework.integration:spring-integration-websocket (4.3.24.release) +1 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.30.release)

org.springframework:spring-websocket MAVEN version 4.3.30.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.ops4j.pax.web.samples:war-vaadin08-spring =9.0.11, =1.2.7, =1.3.11 Source...

org.ops4j.pax.web.samples:war-vaadin08-spring (>=8.0.1, <=9.0.10) potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.29.release)

org.springframework:spring-websocket MAVEN version 4.3.29.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.ops4j.pax.web.samples:war-vaadin08-spring =8.0.1, =9.0.10 Source cves:...

com.caucho:spring4-websocket (>=4.0.62, <=4.0.63), net.apexes.wsonrpc:wsonrpc-server-support (>=2.2.0, <=2.8.0) +3 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.25.release)

org.springframework:spring-websocket MAVEN version 4.3.25.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.caucho:spring4-websocket =4.0.62, =2.2.0, =2.8.0 -...

net.solarnetwork.common:net.solarnetwork.common.web (>=2.2.0, <=2.4.0), org.springframework.boot:spring-boot-starter-websocket (1.5.20.release) +1 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.23.release)

org.springframework:spring-websocket MAVEN version 4.3.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - net.solarnetwork.common:net.solarnetwork.common.web =2.2.0, =2.4.0 -...

org.apereo.cas:cas-server-core-api (>=5.3.7, <=5.3.16), org.apereo.cas:cas-server-core-api-authentication (>=5.3.7, <=5.3.16) +28 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.21.release)

org.springframework:spring-websocket MAVEN version 4.3.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.apereo.cas:cas-server-core-api =5.3.7, =5.3.7, =5.3.7, =5.3.7, =5.3.7,...

io.vilt.minium.developer:minium-developer-bundle (>=1.9.5, <=2.6.0), io.vilt.minium.developer:minium-developer-fs (>=1.9.5, <=2.6.0) +32 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.19.release)

org.springframework:spring-websocket MAVEN version 4.3.19.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - io.vilt.minium.developer:minium-developer-bundle =1.9.5, =1.9.5, =1.9.5,...

io.cettia.asity:asity-bridge-spring-webmvc4 (>=2.0.0-alpha2, <=2.0.0), io.cettia.asity:asity-example-spring-webmvc4 (2.0.0) +263 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.17.release)

org.springframework:spring-websocket MAVEN version 4.3.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - io.cettia.asity:asity-bridge-spring-webmvc4 =2.0.0-alpha2, =2.0.0 -...

com.cjoop:platform-core (0.0.1.release), com.cjoop:platform-security (0.0.1.release) +228 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.16.release)

org.springframework:spring-websocket MAVEN version 4.3.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.cjoop:platform-core 0.0.1.release - com.cjoop:platform-security...

com.almis.awe:awe-boot (>=4.0.4, <=4.0.5), com.almis.awe:awe-controller (>=4.0.3, <=4.1.1) +20 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.14.release)

org.springframework:spring-websocket MAVEN version 4.3.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.almis.awe:awe-boot =4.0.4, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3, =4.0.3,...