{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:16a0cdb1-c36a-5bef-a078-c3b0d0efdc46", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-cas", "purl": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6", "version": "6.2.8-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-security-cas", "purl": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8", "type": "library", "group": "org.springframework.security", "version": "6.2.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:6953d5c9-5e49-5c94-80c8-7d7cdb43d532", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:eb08898f-0b8e-581b-94bc-ceeeeaf034d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:198bdefa-f78e-53d0-b231-37ec58fc31b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:378986d5-10bc-50c0-a555-13f3a4cd1872", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:cd41c46b-c79f-5054-ad08-d6c6f8141a41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:dbbf1af5-408f-5998-88ec-74a4ef191a5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:102240de-9e93-5f14-9209-d5094ba2616c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:b7a93595-09a1-59e5-9a21-380a52646adf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:aae0132b-6056-5bbb-bd1b-595c0230d7e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:64f6bf61-ed5b-51a0-91b6-76998dbb120c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:155be783-41cc-57dd-8cc0-f54b1b9b2d30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:8d4e29a7-caa9-5087-8dab-95d2cdc26776", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:58b2c220-61ab-5188-83d3-2f5ce21965fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:ee25e578-b067-54c6-8592-5ed8399ccfa7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:badbdd0f-5461-533a-82aa-02ba1ea1d77f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:f0f8f598-f35d-546f-a4d3-6ab6ba198bcc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:5fcb1ae4-da82-503d-a419-7bd04790e4b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:e597f4be-d4c0-5925-9fe1-095e86c75b89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:32c5240c-34e6-59c2-b5f5-ba8df421b790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:d167ad05-acf9-56a4-a0ac-1cd32648a99f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:be64b7bd-daab-5456-95b0-b2e6596e1328", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:223575e3-f386-57a1-8a68-d6b6a38e6a86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:24e74b94-88cb-5d67-993b-bc1b67665924", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:352cf094-9fa7-53c3-baa3-f1d6e4de3dab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:24234a71-3510-5418-a5ad-2537b2680b4c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:f01b92ff-6c39-561d-8e0f-25dd0b47a0f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38821 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:dab41897-256a-527b-9adf-a19f3d3d020e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:a8589fcf-abf5-5414-98ff-ccb6db9c024c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:fa567d7b-557e-504f-8e1d-4dadc5c6477c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:5f0821d5-ac7b-5aa0-a52b-146a042b2a66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:4583f5f0-2979-508c-b631-30a324d8782c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas. Spring Security 6.2.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:aff028fe-8865-5c31-88df-0267448f06f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:cc2d4203-01d3-56d5-94a2-704aca8f35a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:bea18fdb-3669-5dab-9a53-9cde0788db97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:0e3b445d-7b0b-5624-bc37-a696fbf19e78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22747 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:334a64a8-4728-550d-9bfb-2a1a19cc4717", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas. not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService) and the entire OneTimeToken authentication feature were introduced in Spring Security 6.4.0, which is a later version than the target 6.2.8-tuxcare.6. The feature does not exist in this codebase, therefore the TOCTOU race condition cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:8a867a59-5d41-587c-864b-de2068ea48fd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas. not_affected \u2014 Version 6.2.8 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean, a class that does not exist in version 6.2.8. Version 6.2.8 uses a completely different architecture (MvcRequestMatcher with property setters) that correctly handles servlet-path configuration without the builder reassignm...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:54ded8a0-9c93-55e8-889a-3f8957aeedc8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:3feb6f46-a105-572f-9607-7f50cca4c2ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:a5459535-4f6f-5f8d-9c6e-364f4c51a09d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 6.2.8 contains no WebAuthn code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:4ed47ef7-3ab7-503e-9248-1f8b1dce10ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:9c0b813c-2cf7-5c11-a7fa-1d5d61facad5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:1f3be735-2911-54a3-b603-05d5ea90cc5f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-cas. not_affected \u2014 Spring Security 6.2.8-tuxcare.6 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class with matchInternal()/matchExternal() builders) does not exist in this version. The CVE affects a utility class that classifies IP addresses as internal vs external for access control purposes, but this functionality is not present in 6.2.8. The existing IpAddressMatcher class s...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@6.2.8-tuxcare.6" } ] }