{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c1b21709-4625-5732-933b-d00dd743028c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-acl", "purl": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2", "version": "5.1.6.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-acl", "purl": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE", "type": "library", "group": "org.springframework.security", "version": "5.1.6.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7968aceb-393a-598e-a303-715884029b13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d1a691e0-fedc-5255-a6df-41c3c53f4e22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f791bc10-76fd-565f-a47d-76e1953154ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c01fa869-1898-50c5-bc1a-9e3d86d37b57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d9c4d655-6de5-5513-b47d-3bab1d368c42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bc5ce9dd-c9a5-5fe1-88ef-d24b2f95fcef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c7c05075-d432-5b6e-ab55-651644214d9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e2af7a65-93d4-52ad-acad-1a761d74bd2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c3a02be6-3498-5d02-baae-4c8987361009", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c29a1f2c-06aa-5b71-b054-7544821f09f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bb69dc3d-8d3c-5030-8066-a766247319d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:34b7795b-f0f1-5dec-9d5d-e3dce95b23ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:de1486a1-a841-505f-98ac-fd9b8b49e162", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:645e13a8-6345-5007-a628-0f2dc1a914ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:82efe220-9386-56fe-b8f5-695d14b33f4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c213243d-9ea5-562b-9506-d620832d0c14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:07e6df8d-0a2c-50ec-abea-87f6a0e7889a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fb6851b5-5329-52e6-9595-dca46fbf4872", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8b641ed7-b4d0-52ec-af49-82b13dad510c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9e4baad4-0d14-5e2d-bc5a-1b358f73f6db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4dc794dd-458e-5ed1-b0a6-c631015817ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4e1ca95a-a7b0-5c20-93ec-67fa69f054a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1a2954ab-f154-5d65-8ee8-f67ee46ea596", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1dcd9a0a-ba0b-50d3-966b-d717bcb52c69", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c012d6f6-625d-5dc0-9a25-6f143b12ba19", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:74fa245b-832f-50cf-8ba0-b7c8763bbcaa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 5.1.6.RELEASE does not contain the vulnerable code. CVE-2025-22223 specifically affects applications using @EnableMethodSecurity (introduced in Spring Security 5.6+), which resolves method security annotations via UniqueSecurityAnnotationScanner. Version 5.1.6 uses the older @EnableGlobalMethodSecurity API with PrePostAnnotationSecurityMetadataSource, a completely different impl...", "justification": "code_not_present" } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4ce1066c-8ed9-513c-aba7-697cfe73ab87", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl. not_affected \u2014 The target spring-security 5.1.6.RELEASE is NOT affected by CVE-2025-22234. This CVE addresses a timing attack vulnerability that was inadvertently introduced by the CVE-2025-22228 fix. However, 5.1.6.RELEASE never received the CVE-2025-22228 backport, so the vulnerable code pattern (unconditional 72-byte password length check in BCrypt.hashpw that breaks DaoAuthenticationProvider's timing atta...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f1ac82a2-3212-5af9-9ab1-2c6bff927fb5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41232 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:64dd613d-0327-5e4c-b49a-91d88f678fea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fd375c3a-13b8-52af-83fc-bdf6b376aeb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:305c9fea-68a5-599c-8d5e-c824f4040fc3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) was introduced in Spring Security 6.4.0-M4 (July 2024), long after the 5.1.6 release. The target version does not contain the vulnerable code, cannot process one-time token authentication requests, and lacks the authen...", "justification": "code_not_present" } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:df453c62-5aca-53e6-b5a2-ca47bf9b6279", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:370b3347-e247-56ef-a4c0-2f4763c5a16e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-59277. The vulnerable component InetAddressMatchers (with matchInternal() and matchExternal() methods) does not exist in this version. The class was introduced in later versions of Spring Security. Version 5.1.6 only contains IpAddressMatcher, a CIDR-based subnet matcher without internal/external IP classification capabilities,...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.1.6.RELEASE-tuxcare.2" } ] }