ROOT-APP-MAVEN-CVE-2025-41254 CVE-2025-41254 in org.springframework:spring-websocket - Patched by Root

Root has patched CVE-2025-41254 in the org.springframework:spring-websocket package for Root:Maven. Multiple fixed versions available...

Predictable WebSocket Session IDs

org.springframework, spring-websocket is vulnerable to Predictable WebSocket Session IDs. The vulnerability is due to WebSocket session IDs in the spring-websocket module not being cryptographically unpredictable, which allows an attacker to potentially predict valid session IDs and gain...

ai.driftkit:driftkit-workflow-controllers (>=0.7.5, <=0.9.2), ai.driftkit:driftkit-workflow-engine-spring-boot-starter (>=0.7.0, <=0.9.2) +724 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (>=6.1.0, <=6.1.21)

org.springframework:spring-websocket MAVEN version =6.1.0, =0.7.5, =0.7.0, =0.5.0, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.6, =1.0.1, =1.0.1, =1.0.31 and more Source cves: CVE-2026-41838 Source advisory: GHSA-Q723-847Q-5G8G...

org.springframework.boot:spring-boot-starter-websocket (1.5.17.release), org.springframework.integration:spring-integration-websocket (4.3.18.release) potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.20.release)

org.springframework:spring-websocket MAVEN version 4.3.20.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.springframework.boot:spring-boot-starter-websocket 1.5.17.release -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.4, <=2.5), com.themodernway:themodernway-server-core (>=1.0.1-release, <=1.0.5-release) +55 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.7.release)

org.springframework:spring-websocket MAVEN version 4.3.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.4, =1.0.1-release, =1.0.1.1-releas...

io.vilt.minium.developer:minium-developer-bundle (>=1.9.5, <=2.6.0), io.vilt.minium.developer:minium-developer-fs (>=1.9.5, <=2.6.0) +32 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.19.release)

org.springframework:spring-websocket MAVEN version 4.3.19.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - io.vilt.minium.developer:minium-developer-bundle =1.9.5, =1.9.5, =1.9.5,...

com.ahome-it:ahome-tooling-server-core (>=1.1.19-release, <=1.1.26-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.23-release, <=1.1.25-release) +114 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.4.release)

org.springframework:spring-websocket MAVEN version 4.3.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.19-release, =1.1.23-release,...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.0, <=2.2), com.ahome-it:ahome-tooling-server-core (>=1.1.4-release, <=1.1.9-release) +12 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.1.release)

org.springframework:spring-websocket MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.0, =1.1.4-release, =1.1.4-release,...

com.ahome-it:ahome-tooling-server-core (1.0.109-release), com.ahome-it:ahome-tooling-server-hazelcast (1.0.109-release) +8 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.2.0.release)

org.springframework:spring-websocket MAVEN version 4.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.ahome-it:ahome-tooling-server-core 1.0.109-release -...

com.ahome-it:ahome-tooling-server-core (>=1.1.10-release, <=1.1.12-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.10-release, <=1.1.12-release) +110 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.2.release)

org.springframework:spring-websocket MAVEN version 4.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.10-release, =1.1.10-release,...

com.ahome-it:ahome-tooling-server-core (>=1.1.0-release, <=1.1.1-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.0-release, <=1.1.1-release) +12 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.2.6.release)

org.springframework:spring-websocket MAVEN version 4.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.0-release, =1.1.0-release,...

com.35liuqi:summer-web-framework (1.0), com.consol.citrus:citrus-websocket (2.7.2) +200 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.9.release)

org.springframework:spring-websocket MAVEN version 4.3.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.35liuqi:summer-web-framework 1.0 - com.consol.citrus:citrus-websocket 2.7.2...

com.cjoop:platform-core (0.0.1.release), com.cjoop:platform-security (0.0.1.release) +228 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.16.release)

org.springframework:spring-websocket MAVEN version 4.3.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.cjoop:platform-core 0.0.1.release - com.cjoop:platform-security...

com.kurento.kmf:kmf-broker (4.3.1), com.kurento.kmf:kmf-content-api (4.3.1) +9 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.0.6.release)

org.springframework:spring-websocket MAVEN version 4.0.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.kurento.kmf:kmf-broker 4.3.1 - com.kurento.kmf:kmf-content-api 4.3.1 -...

com.ebay:lightning-client (0.9.0), com.ebay:lightning-core (0.9.0) +1 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.0.3.release)

org.springframework:spring-websocket MAVEN version 4.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.ebay:lightning-client 0.9.0 - com.ebay:lightning-core 0.9.0 -...

org.springframework.integration:spring-integration-websocket (4.3.22.release) potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.26.release)

org.springframework:spring-websocket MAVEN version 4.3.26.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - org.springframework.integration:spring-integration-websocket 4.3.22.release...

com.github.demon214:dstudio.web (>=0.0.1, <=1.0.5), com.github.tianjing:tgtools.activiti.explorer (>=5.22.0.14, <=5.22.0.16) +11 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.1.5.release)

org.springframework:spring-websocket MAVEN version 4.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.github.demon214:dstudio.web =0.0.1, =5.22.0.14, =5.22.0.6, =1.0.4, =2.2.1.8...

com.almis.awe:awe-controller (>=4.1.2, <=4.1.7), com.almis.awe:awe-developer (>=4.1.2, <=4.1.7) +11 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.24.release)

org.springframework:spring-websocket MAVEN version 4.3.24.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - com.almis.awe:awe-controller =4.1.2, =4.1.2, =4.1.2, =4.1.2, =4.1.2, =4.1.2,...

io.antmedia.webrtc:streamapp (>=2.2.0, <=2.4.2.1), org.springframework.integration:spring-integration-websocket (4.3.23.release) potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.28.release)

org.springframework:spring-websocket MAVEN version 4.3.28.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - io.antmedia.webrtc:streamapp =2.2.0, =2.4.2.1 -...

io.cettia.asity:asity-bridge-spring-webmvc4 (>=2.0.0-alpha2, <=2.0.0), io.cettia.asity:asity-example-spring-webmvc4 (2.0.0) +263 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.17.release)

org.springframework:spring-websocket MAVEN version 4.3.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - io.cettia.asity:asity-bridge-spring-webmvc4 =2.0.0-alpha2, =2.0.0 -...