Security Bulletin: Multiple Vulnerabilities in watsonx.data

Summary Multiple vulnerabilities were addressed in watsonx.data 2.4.0 patch 5. Vulnerability Details CVEID:CVE-2026-41838 DESCRIPTION: IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate...

ROOT-APP-MAVEN-CVE-2025-41254 CVE-2025-41254 in org.springframework:spring-websocket - Patched by Root

Root has patched CVE-2025-41254 in the org.springframework:spring-websocket package for Root:Maven. Multiple fixed versions available...

Predictable WebSocket Session IDs

org.springframework, spring-websocket is vulnerable to Predictable WebSocket Session IDs. The vulnerability is due to WebSocket session IDs in the spring-websocket module not being cryptographically unpredictable, which allows an attacker to potentially predict valid session IDs and gain...

com.kurento.kmf:kmf-broker (4.3.1), com.kurento.kmf:kmf-content-api (4.3.1) +9 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.0.6.release)

org.springframework:spring-websocket MAVEN version 4.0.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.kurento.kmf:kmf-broker 4.3.1 - com.kurento.kmf:kmf-content-api 4.3.1 -...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), br.com.m4rc310:br-com-m4rc310-graphql (1.0.1) +1877 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (>=5.0.0.release, <=5.3.39)

org.springframework:spring-websocket MAVEN version =5.0.0.release, =4.4.0.0, =3.4.0, =5.6.5, =4.1.0, =4.1.0, =3.6.0, =3.1.0, =5.3.0, =6.2.0, =5.1.0, =6.8.0, =6.10.5 and more Source cves: CVE-2026-41838 Source advisory: GHSA-Q723-847Q-5G8G...

org.ops4j.pax.web.samples:war-vaadin08-spring (>=9.0.11, <=10.1.2), org.springframework.integration:spring-integration-websocket (4.3.24.release) +1 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.30.release)

org.springframework:spring-websocket MAVEN version 4.3.30.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.ops4j.pax.web.samples:war-vaadin08-spring =9.0.11, =1.2.7, =1.3.11 Source...

io.antmedia.webrtc:streamapp (>=2.2.0, <=2.4.2.1), org.springframework.integration:spring-integration-websocket (4.3.23.release) potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.28.release)

org.springframework:spring-websocket MAVEN version 4.3.28.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - io.antmedia.webrtc:streamapp =2.2.0, =2.4.2.1 -...

org.springframework.integration:spring-integration-websocket (4.3.22.release) potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.26.release)

org.springframework:spring-websocket MAVEN version 4.3.26.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.springframework.integration:spring-integration-websocket 4.3.22.release...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (2.3), com.ahome-it:ahome-tooling-server-core (>=1.1.32-release, <=1.1.36-release) +38 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.6.release)

org.springframework:spring-websocket MAVEN version 4.3.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 2.3 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +6 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.0.release)

org.springframework:spring-websocket MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

at.aimon.ops:aimon-ops-api (>=0.0.1, <=0.0.2), br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21) +1097 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (>=6.2.0, <=6.2.18)

org.springframework:spring-websocket MAVEN version =6.2.0, =0.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-41838 Source advisory: OSV:GHSA-Q723-847Q-5G8G...

at.aimon.ops:aimon-ops-api (>=0.0.1, <=0.0.2), br.com.archbase:archbase-annotation-processor (>=2.0.0, <=2.1.21) +1097 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (>=6.2.0, <=6.2.18)

org.springframework:spring-websocket MAVEN version =6.2.0, =0.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.0.0, =2.0.0, =2.0.0, =2.1.21 and more Source cves: CVE-2026-41838 Source advisory: GHSA-Q723-847Q-5G8G...

ai.driftkit:driftkit-workflow-controllers (>=0.7.5, <=0.9.2), ai.driftkit:driftkit-workflow-engine-spring-boot-starter (>=0.7.0, <=0.9.2) +732 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (>=6.1.0, <=6.1.21)

org.springframework:spring-websocket MAVEN version =6.1.0, =0.7.5, =0.7.0, =0.5.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.6, =1.0.1, =1.0.1, =1.0.31 and more Source cves: CVE-2026-41838 Source advisory: GHSA-Q723-847Q-5G8G...

net.solarnetwork.common:net.solarnetwork.common.web (>=2.2.0, <=2.4.0), org.springframework.boot:spring-boot-starter-websocket (1.5.20.release) +1 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.23.release)

org.springframework:spring-websocket MAVEN version 4.3.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - net.solarnetwork.common:net.solarnetwork.common.web =2.2.0, =2.4.0 -...

cn.ymotel:dactor (>=1.0.1, <=1.0.15), org.springframework.boot:spring-boot-starter-websocket (1.5.19.release) +1 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.22.release)

org.springframework:spring-websocket MAVEN version 4.3.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - cn.ymotel:dactor =1.0.1, =1.0.15 -...

io.cettia.asity:asity-bridge-spring-webmvc4 (>=2.0.0-alpha2, <=2.0.0), io.cettia.asity:asity-example-spring-webmvc4 (2.0.0) +263 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.17.release)

org.springframework:spring-websocket MAVEN version 4.3.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - io.cettia.asity:asity-bridge-spring-webmvc4 =2.0.0-alpha2, =2.0.0 -...

com.consol.citrus:citrus-websocket (2.7.3), com.estafet.microservices.scrum:microservices-scrum-parent-db (>=1.0.0, <=1.0.4) +236 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.11.release)

org.springframework:spring-websocket MAVEN version 4.3.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.consol.citrus:citrus-websocket 2.7.3 -...

com.35liuqi:summer-web-framework (1.0), com.consol.citrus:citrus-websocket (2.7.2) +200 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.9.release)

org.springframework:spring-websocket MAVEN version 4.3.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.35liuqi:summer-web-framework 1.0 - com.consol.citrus:citrus-websocket 2.7.2...

com.caucho:spring4-websocket (>=4.0.62, <=4.0.63), net.apexes.wsonrpc:wsonrpc-server-support (>=2.2.0, <=2.8.0) +3 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.25.release)

org.springframework:spring-websocket MAVEN version 4.3.25.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.caucho:spring4-websocket =4.0.62, =2.2.0, =2.8.0 -...

org.springframework.boot:spring-boot-starter-websocket (1.5.17.release), org.springframework.integration:spring-integration-websocket (4.3.18.release) potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.20.release)

org.springframework:spring-websocket MAVEN version 4.3.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.springframework.boot:spring-boot-starter-websocket 1.5.17.release -...