{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c42c2883-b176-5a2d-b42b-3784ebf12c04", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-acl", "purl": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1", "version": "5.1.6.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-acl", "purl": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE", "type": "library", "group": "org.springframework.security", "version": "5.1.6.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:abb0b540-008f-53b6-a036-e4e1023706a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:306b644b-fca7-500c-90b6-f93662f683b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ac2b24ad-b85b-5dca-adce-2df657281efb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:490f1028-97d0-5375-a44f-ee0d237aa39a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bee92f8e-eedf-5297-be72-875e23213666", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1fec6d49-9990-5d90-ab09-e6c2c9e385ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2e30e155-d1fd-5be7-8e2d-3aaa541258a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:09e4cb0e-af74-539e-a56e-5a8650a67cbc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cb40a3c0-d856-581b-879f-0598a2d95c8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:628f3182-1f9c-534e-a948-65f350e84ed9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:605dda9d-2164-5039-aa0b-aaf2d73dc770", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d3ce0b6b-6ede-5cc7-bc7d-95dbc3f86027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d1df2c32-1bf1-5724-a132-981c30c164f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d2091d51-8e73-5626-91d4-9d39a2db0101", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5a3b287e-00db-5c12-8542-ee5ce9f417ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:eef19a9a-3ff4-5fc4-8314-c1afe8143ddc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d288489d-c90e-5ddd-b461-d45c595aa803", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:659f5648-3493-5a76-9874-07c547e58bc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:96908f4b-339c-5671-8fe0-aafc4c0d3a2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b50026e3-3ab5-5477-978a-9b8a9ac55e52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:aad5ea24-5f44-5d39-a317-4cd6340f83c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1f07f204-fae1-57e6-9892-0f7a1ef3c4d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f579239c-d668-5399-bda1-51fda34ecef6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f629dadc-31db-5366-97bb-b172ff3fe9b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:75de1235-1625-5971-92db-1cd3615b4048", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6d73bdb8-c36c-5b02-baae-03434c9ff9ed", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 5.1.6.RELEASE does not contain the vulnerable code. CVE-2025-22223 specifically affects applications using @EnableMethodSecurity (introduced in Spring Security 5.6+), which resolves method security annotations via UniqueSecurityAnnotationScanner. Version 5.1.6 uses the older @EnableGlobalMethodSecurity API with PrePostAnnotationSecurityMetadataSource, a completely different impl...", "justification": "code_not_present" } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d11a0626-4469-58f5-acd4-d814750c6559", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl. not_affected \u2014 The target spring-security 5.1.6.RELEASE is NOT affected by CVE-2025-22234. This CVE addresses a timing attack vulnerability that was inadvertently introduced by the CVE-2025-22228 fix. However, 5.1.6.RELEASE never received the CVE-2025-22228 backport, so the vulnerable code pattern (unconditional 72-byte password length check in BCrypt.hashpw that breaks DaoAuthenticationProvider's timing atta...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cb999aef-50d7-5cdc-9043-328d262a4c2c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.1.6.RELEASE does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cd5f5e01-cd2f-5a6f-9f74-64362ae1b462", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.1.6.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:92a6fccf-a670-58ec-befa-3d27b20f9d28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e135a400-904a-56ba-b0f2-6be32f2f00ff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) was introduced in Spring Security 6.4.0-M4 (July 2024), long after the 5.1.6 release. The target version does not contain the vulnerable code, cannot process one-time token authentication requests, and lacks the authen...", "justification": "code_not_present" } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:de987922-47a5-5542-9dee-04d2f809c18b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:92bbab72-a88a-5c2d-bbc6-b61ddb391014", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-59277. The vulnerable component InetAddressMatchers (with matchInternal() and matchExternal() methods) does not exist in this version. The class was introduced in later versions of Spring Security. Version 5.1.6 only contains IpAddressMatcher, a CIDR-based subnet matcher without internal/external IP classification capabilities,...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.1" } ] }