{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:01bf7039-f0cc-5e18-9ab3-6d40f53149ea", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5", "version": "6.2.8-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8", "type": "library", "group": "org.springframework.security", "version": "6.2.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:4410826c-0a42-5023-b314-db5ae8469041", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:af6eec90-672f-5b89-9e29-df4bf7217eee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:d7876b96-036b-5d3a-85fd-1d2202b8b1e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:bd9280b4-bc85-50df-8f54-4af4654ed606", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:253ad4e1-9aa7-5dd4-bd25-7cf6ee876c84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:3928195a-25b5-5ca8-85ed-4e055de8d0af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:a553e9ca-014c-5139-ac24-eed876f08405", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ce3ffc71-0924-58f9-9771-5b2162cb89ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:82e4056f-b474-54dc-bc68-f923c5ec5d34", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:b5dab664-7bb8-50db-be0e-bfe2645fb817", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:884cf0c0-2328-5323-8179-0783329a5d1a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:9e9a4313-ed80-5422-9020-e74e509e4fa2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:5f75d409-c5ce-541b-aa2c-14326fb0bdf2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:63551991-24d7-59e8-ab6b-8b5ea2e16e17", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:3224e4d7-e9bb-51dc-9f30-2248fc12b764", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:e273e3b8-ae02-567a-96e4-bffb20d97da4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:72b1cec3-c916-5dbe-ad12-cb39591f903b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:5975b992-3820-5dce-84f5-0da99f7e6f30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:4edbeb37-fc23-5a56-8d5b-f4db41f097e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:4c4e534c-745c-51be-a37f-5a05bd565a65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:036e8b8e-6a66-5c73-bfad-877a53b22ae0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:5f796016-4e66-52f4-b99b-229334f96882", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:cbfb2f54-1a70-5acd-9682-1aabfab4f89d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:8f8983b3-a8d7-56b4-b70b-3e36eb9e7171", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:09739f30-e74a-5e7d-863a-9c406ecb4516", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:e76ef633-3e33-5051-bed0-4b09035cb814", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ab46d2bc-1720-5344-887b-5f9262afae6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:fd7e0cfe-9688-51da-82d1-3774e0406f02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:613c131a-e8e2-54f1-9744-60f7a667dd4d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects. Spring Security 6.2.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:aa5b9661-478a-5cf2-a4c2-15884732bbdd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:fea31d7a-ba29-5644-871e-3b25ebfaf6c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ffb8ea92-3dff-5161-a463-5e0c8b78fc5c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService) and the entire OneTimeToken authentication feature were introduced in Spring Security 6.4.0, which is a later version than the target 6.2.8-tuxcare.6. The feature does not exist in this codebase, therefore the TOCTOU race condition cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:3eea2816-6c0b-5fd6-9d86-81af2bc2028f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:c1a1d645-0138-50aa-9f4c-d34ae83a4d34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:47bd3be7-f562-518c-a58e-32aa4046f30b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-aspects. not_affected \u2014 Spring Security 6.2.8-tuxcare.6 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class with matchInternal()/matchExternal() builders) does not exist in this version. The CVE affects a utility class that classifies IP addresses as internal vs external for access control purposes, but this functionality is not present in 6.2.8. The existing IpAddressMatcher class s...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.2.8-tuxcare.5" } ] }