{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:90fe1f65-8a18-57f6-b9d0-286863be5516", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.4", "type": "library", "group": "org.springframework.security", "name": "spring-security-acl", "version": "6.2.8-tuxcare.4", "purl": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:b2a8801d-3958-50c5-b4f0-56c4c355edc7", "id": "CVE-2025-22228", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-acl." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:763d4c52-ed63-5605-8ae7-f695ebefe398", "id": "CVE-2025-22234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-acl." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:de32eacc-a62e-59c9-a0b3-debe9e4473c0", "id": "CVE-2026-22732", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-acl." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0e20fe3b-1b29-56b3-bd73-219a4b8d25ca", "id": "CVE-2026-22746", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-acl." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:7c50760f-e2fa-5444-ae61-26a5abffd601", "id": "CVE-2026-22747", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22747 affects version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-acl." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:78eab845-dea0-5eac-8020-bcf5770c0c3d", "id": "CVE-2026-22748", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22748 is fixed in version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-acl." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1c5570a5-d689-5a0d-a616-1a98a88f02cb", "id": "CVE-2026-22753", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22753 does not affect version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2026-22753. The vulnerability is specific to PathPatternRequestMatcher.Builder functionality introduced in Spring Security 7.0.0. Version 6.2.8 uses a different request matching architecture (MvcRequestMatcher and AntPathRequestMatcher) that does not contain the vulnerable code pattern." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:68739ffb-57ba-5949-82c3-863952a50283", "id": "CVE-2026-22754", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-acl. not_affected \u2014 Version 6.2.8 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean, a class that does not exist in version 6.2.8. Version 6.2.8 uses a completely different architecture (MvcRequestMatcher with property setters) that correctly handles servlet-path configuration without the builder reassignm..." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:737ad555-f507-5984-95c5-7dfb67f0feb8", "id": "CVE-2026-40988", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40988 is fixed in version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-acl." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cff1b137-8440-5374-a08e-4cc3397690f1", "id": "CVE-2026-40993", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40993 does not affect version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-acl. Spring Security 6.2.8 is not affected by CVE-2026-40993. The vulnerable component JdbcAssertingPartyMetadataRepository does not exist in this version. The CVE specifically affects Spring Security 7.0.0 - 7.0.5, where the JDBC-based SAML2 asserting party metadata repository was introduced. Version 6.2.8 only contains in-memory and HTTP session-based SAML2 repositories, with no JDBC-based implementation for asserting party metadata storage. The vulnerability pattern (unsafe deserialization of credentials from database columns) cannot manifest because the affected code path does not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:943b461b-0059-51de-8009-ff15152f5c3a", "id": "CVE-2026-41003", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41003 is fixed in version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-acl." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ca558f79-0412-5b67-99fc-dac54d3f9427", "id": "CVE-2026-41694", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41694 is fixed in version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-acl." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:32e17d87-d515-5e98-acab-bd7ad0ed5f42", "id": "CVE-2026-41706", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-acl." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:339ba53f-861f-57a7-b9cd-74fde228b671", "id": "CVE-2026-47838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-acl." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.2.8-tuxcare.4" } ] }