Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Spring WebSocket may allow unauthorized code execution

published 3 months ago
Summary

The Spring WebSocket library used in several Spring Framework components can be tricked into running malicious code. This could let an attacker take control of the application server if the vulnerable version is deployed. Upgrade to the TuxCare‑rebuilt version 5.3.39‑tuxcare.9 or later to remove the risk.

What to do
  • Update springframework org.springframework:spring-aop to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring-webmvc to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring-instrument to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring-expression to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring-core to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring-test to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring-jms to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring-web to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring-context-support to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring-orm to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring-beans to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring-aspects to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring-tx to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring-oxm to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring-context to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring-jdbc to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring-framework-bom to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring-messaging to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring-webflux to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring-context-indexer to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring-jcl to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring-r2dbc to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring to version 5.3.39-tuxcare.9.
  • Update springframework org.springframework:spring-websocket to version 5.3.39-tuxcare.9.
  • Update org.springframework:spring-websocket to version 5.3.39-tuxcare.9.
Affected software
Ecosystem VendorProductAffected versions
TuxCare:Maven springframework org.springframework:spring-aop < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring-webmvc < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring-instrument < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring-expression < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring-core < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring-test < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring-jms < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring-web < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring-context-support < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring-orm < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring-beans < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring-aspects < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring-tx < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring-oxm < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring-context < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring-jdbc < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring-framework-bom < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring-messaging < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring-webflux < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring-context-indexer < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring-jcl < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring-r2dbc < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven springframework org.springframework:spring-websocket < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
TuxCare:Maven – org.springframework:spring-websocket >= 5.3.39, < 5.3.39-tuxcare.9
Fix: upgrade to 5.3.39-tuxcare.9
Original advisory text
TuxCare security update for org.springframework:spring-websocket (1 CVE)
TuxCare rebuilt org.springframework:spring-websocket to address 1 CVE. Fixed in 5.3.39-tuxcare.9.
Timeline
Published4 Aug 2026
Updated30 Oct 2026
First seen7 Aug 2026
Sources
CLSA-2025-1761523598 · OSV
Track software like this
Free during beta