{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c3336fc2-eb8a-5c8a-989d-64ab19c82df2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-acl", "purl": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18", "version": "6.3.10-tuxcare.18", "pedigree": { "ancestors": [ { "name": "spring-security-acl", "purl": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10", "type": "library", "group": "org.springframework.security", "version": "6.3.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:862750eb-fe5f-5621-8f2d-76bbdd4f8e38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:e315f105-c565-535c-8797-eb79c7710e30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:087f93ff-d462-591c-95e8-12bda439958b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:fe0583a8-eed8-5ab8-965a-2cea92bf3822", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:e152c2b1-08dc-5d01-accd-13463a0b464c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:261ae9c4-5589-59df-90d2-92d46b04810e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:52021158-6c76-5a0b-bd91-32f21202fa77", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:6db0030b-35b7-5866-a548-31931c9150b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:278378c6-314a-57ce-8605-eef277cfbc2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:b4f7c191-ac07-56be-92d6-687480cc6084", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:5c29241b-dcc7-5c8e-98a1-2ac08b3c5753", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:6dcf90c5-f41d-5a2b-8d78-1110695c6a4d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1258 does not affect version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl. not_affected \u2014 The target Spring Security 6.3.10-tuxcare.7 is not affected by CVE-2018-1258. The vulnerability existed in Spring Framework versions 5.0.5/5.0.6 and was fixed in Spring Framework 5.0.7 (June 2018). The target depends on Spring Framework 6.1.20-tuxcare.5, which is approximately 6 years newer than the fixed version and contains all security fixes from 5.0.7 onwards.", "justification": "requires_dependency" } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:a5eb9025-7d85-5aa0-b80a-37ae09460980", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:4d48d859-a203-5c2a-be0b-bb150b46883b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:6acf433c-d504-5b7b-bc8f-f961c9ffbb7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:75a06abc-4445-5296-9e21-b4c66e85f475", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:41d0652b-21d0-56da-a631-59bb7fa853d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:94d29057-ed63-508c-9e45-7b25ccb1ca27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:41fd30ee-3785-507a-a005-ed665b4ca462", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:73fd1e97-cbda-5ad9-848d-6df2e6ee1ecf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:8d759d5f-13bc-54d0-8751-014aaaecaf15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:bda244b4-0f9b-5d39-89fa-f1c43dd44b5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:de08701d-02eb-5558-a1ce-a4d215911bce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:6298f28d-51ae-5a8b-a639-3087dd641cf8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:e43849cf-27e8-586a-ac2d-bdcd8f2397cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:37f5dd48-728d-5dba-9761-710dd441e9c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:afb08ed8-421c-5a23-b5e7-92f1b076c151", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:5164709d-f287-5080-8334-54cccd6421ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:326df3de-7048-5eb7-a7fd-f0aa45cd6a48", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl. not_affected \u2014 The target repository (spring-security 6.3.10-tuxcare.21) is NOT AFFECTED by CVE-2025-22234. The vulnerability was fixed by upstream Spring Security in commit c1aa99fdd2113a232986e9c3a44673ae752de840 (dated 2025-04-17) before TuxCare onboarded version 6.3.10. The fix conditionalizes the 72-byte password length check to only apply when encoding new passwords (!for_check), not during authenticati...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:970b4010-6003-513c-a092-154219e6fcc2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl. Spring Security 6.3.10 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:ea8af53f-fff5-5180-a3e4-a23e751eec59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:e0011f64-078a-51cf-b8d9-1d59342d3453", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:c24a9fde-2c03-5c7e-a8d1-1546e7e1411a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.4.0, which postdates this target version. The one-time token authentication feature does not exist in 6.3.10.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:08e8965c-e77b-588c-80eb-2daecd1580af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47842 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl, and is fixed in 6.3.10-tuxcare.20." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:dfeb2b2b-bcad-59e4-8da7-b5879c4691ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl, and is fixed in 6.3.10-tuxcare.20." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:de9a5e60-b4e5-5bc0-a29e-672957b13b4f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-acl. not_affected \u2014 Spring Security 6.3.10 does not contain the InetAddressMatchers class or its matchInternal()/matchExternal() methods that are affected by CVE-2026-59277. The vulnerability concerns incorrect classification of \"any local\" addresses (0.0.0.0 and ::) as external rather than internal. This functionality was introduced in a later version of Spring Security (patches dated June/July 2026, after the 6....", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-acl@6.3.10-tuxcare.18" } ] }