{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:00366971-f568-5cd6-b081-d03f1f37766b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-acl", "purl": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1", "version": "5.7.7-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-acl", "purl": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7", "type": "library", "group": "org.springframework.security", "version": "5.7.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:1d89df7d-060a-5f56-8767-c67592a90151", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:41dab3a5-7304-53ab-b4e0-196d9fc4f7e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:0daba6e4-e04a-5843-94e8-a21c7f3861b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:36680359-1197-5c63-bb73-554f62cb5588", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:26870619-bf72-5159-a974-e7a49bafebfa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:0f8ac31b-3472-5baa-b152-94420fc951bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:069013e5-a68c-5061-b900-43274134262e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:21299ecf-3f88-5efd-868f-23942f5db187", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:0f04731e-acf9-5cb6-81ed-ebb1f48d2ab6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:be1231b0-ae30-5545-9e2b-c67ff7048225", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:f7144ed1-aa5b-581c-9349-6b2353d674d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:7c4ca71b-a5ff-5b16-bd64-0fef6d3ca204", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:68640ea9-7b05-5d50-bcd6-c61f137fad3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:f1a850c2-d0a3-5ae9-9724-25faf0de3a48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:107c0f08-210a-5c28-8912-2770caa9f2e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:1f1f1bf9-fe24-520c-af7f-69a807275dcb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:8d6dbc79-dcf2-59fd-8c09-0aceaaf6fa19", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:78de095a-3211-5a35-b2e7-8e9f6a8052e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:94c97e0b-ad75-50c8-b443-2bf70de64f96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:a211d1a8-5058-545d-b17d-f9abe19bf109", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:0e10a523-cddf-53c1-890f-04d17d628097", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:00988665-508a-5db8-98fb-b58b916a9ea2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:0ab06e3c-be7f-599b-8886-59572031c720", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:00565cb4-109d-534a-8655-3aa27f5fcce3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:e9eaabc4-643f-552d-9887-789880167324", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:1fb1f125-ad1d-5e3b-b725-837adc50f7e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:7bc2cc64-1e44-581f-b4d2-f4057480b9d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:9ba9d0c0-459d-5272-8079-c5fb6e6ac682", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2025-22234. This CVE is a secondary vulnerability introduced by the fix for CVE-2025-22228, which added a password length check to BCrypt that broke timing attack mitigation. The target version (5.7.7) never received the CVE-2025-22228 fix, and therefore does not contain the problematic code that causes CVE-2025-22234. The timing attack mitigation in...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:ad9a7592-6a1c-5269-beec-58a0850593fe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.7.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:8a9326a7-8766-5062-afc8-a306847a34bc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl. Spring Security 5.7.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:478c9a0c-fd0b-567f-a575-0d11e59a5b37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:c16f39e1-5982-5203-bf93-e456c1dd7a99", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-22751 because the vulnerable component (JdbcOneTimeTokenService) does not exist in this version. The One-Time Token (OTT) authentication feature was introduced in Spring Security 6.4.0, and version 5.7.7 predates this feature entirely. Comprehensive searches across the codebase found no JdbcOneTimeTokenService class, no OneTimeToken-related code...", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:913874ab-d7cd-54c8-ab32-ab3a72578d2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47842 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl, and is fixed in 5.7.7-tuxcare.2." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:1fa51713-77a2-58a7-835f-27d47eeeb488", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl, and is fixed in 5.7.7-tuxcare.2." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ], "bom-ref": "urn:uuid:31841d93-1c48-56e4-9f22-2ead03d9f753", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-59277. The vulnerable component, the InetAddressMatchers utility class with matchInternal()/matchExternal() builders for classifying IP addresses as internal or external networks, does not exist in this version. The CVE describes a misclassification vulnerability where 0.0.0.0 and :: are incorrectly treated as external addresses. However, versio...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@5.7.7-tuxcare.1" } ] }