{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d4712ee6-406d-5192-a0a3-66245ceedf56", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-config", "purl": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1", "version": "5.1.5.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-config", "purl": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE", "type": "library", "group": "org.springframework.security", "version": "5.1.5.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:332288cb-9b5a-5863-a3d7-40859cce9181", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b0616f54-2aae-5582-9611-3941f53071d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:14afe282-210c-5cb4-99dc-ac7f01070969", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c781acbf-a3be-500e-9c0d-c2a7bfa6a492", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b5e2e304-c533-5054-89a2-1af93a4ed66c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:594f0e69-1c1d-5e10-996b-d111a76b270c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:856453d3-3320-5981-82ad-f0c040bda300", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e238b77f-cbe2-5342-a116-0bbe68c9a109", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:765034fd-f36e-559f-b7f7-97ae57e1a3d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:70c4156c-2bae-5b22-891a-462ccb0b294a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:adbe30ff-d3c0-5e6d-aaba-8d266359ba65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9b83a2be-0de9-58ab-a326-51b08c3e5e24", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f0b60ad8-3e52-5dd9-b479-472f8ceb5ca2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e2cdbb1a-868d-5a9e-816d-4439db9bdff3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-3795 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. not_affected \u2014 The target repository (Spring Security 5.1.5.RELEASE-tuxcare.1) is NOT AFFECTED by CVE-2019-3795. The vulnerability involved insecure randomness when SecureRandomFactoryBean#setSeed was used to configure a SecureRandom instance - specifically, calling setSeed() before any random bytes were generated would cause the user-provided seed to REPLACE the entire internal RNG state rather than suppleme...", "justification": "code_not_present" } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:66f11ea0-71cc-51b9-bd96-b7839014872d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f476be9f-c697-53f0-83f7-9bfbdc886335", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9d58777d-0e6a-5da7-964b-f05195bd55bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ba4998d6-782b-50fe-a1f5-f807b83e38d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3185d9f1-7573-5c29-a00a-87925a2f0a51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0de13251-b2f7-51dc-9f38-6bd7a309e333", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:13fc80c5-687f-5e2c-92d4-4fa65454dc8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2023-34034", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2e9edf9f-16e1-5f48-8407-2d989a57d06b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34034 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2023-34035", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b9f577aa-f30b-5b5c-b6f6-989644d102ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34035 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2023-34042", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:594c85d9-9081-57cd-b742-93c657322735", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34042 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. not_affected \u2014 The target Spring Security version 5.1.5.RELEASE does not contain CVE-2023-34042's vulnerable pattern. The vulnerability concerns a symlink file (spring-security.xsd) with world-writable permissions in the JAR artifact. This symlink was introduced in Spring Security 5.7.9+ (commit 1eefd433b6, May 2023) and fixed in 5.7.11+/5.8.7+/6.0.7+/6.1.4+ (commit 5b293d2116, Sept 2023). The target version ...", "justification": "code_not_present" } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3127e314-f89f-5db1-bcad-d7e2d479c727", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:22012225-c0ed-5298-a35f-53feca16bc29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b63eb77f-ad75-54fe-a0fc-cfb04d7a6c11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:64e20059-62dc-5445-8b57-e601325a6f80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:238efc3d-91ed-534e-8ccc-67e2bde50235", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 5.1.5.RELEASE is not affected by CVE-2025-22223. The vulnerability requires @EnableMethodSecurity and the UniqueSecurityAnnotationScanner class, both introduced in Spring Security 6.0.0. Version 5.1.5 uses @EnableGlobalMethodSecurity with PrePostAnnotationSecurityMetadataSource, which relies on Spring Framework's ClassUtils.getMostSpecificMethod() to correctly resolve annotation...", "justification": "code_not_present" } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:22065005-aa14-5257-96e6-23d3358d44eb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. not_affected \u2014 Target version 5.1.5.RELEASE is not affected by CVE-2025-22234. This CVE fixes a timing attack vulnerability introduced by CVE-2025-22228, which added an unconditional 72-byte password length check that broke timing attack mitigation in DaoAuthenticationProvider. The target does not have CVE-2025-22228 applied, therefore it cannot have the timing oracle vulnerability that CVE-2025-22234 address...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:499977d6-f064-5288-9d25-3830fbfa83e1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.1.5.RELEASE does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5c3114e8-92bb-5fc2-9e34-fb486f31d77e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.1.5.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b41a6c32-246f-529e-ab1e-ffc9d1f1a518", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e7cd53e9-d212-509b-acfa-357c8e7e3e3a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 5.1.5.RELEASE does not contain the One-Time Token (OTT) authentication feature. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.3.x, several major versions after 5.1.5. The target codebase does not process one-time authentication tokens and therefore cannot be affected by the TOCTOU race condition described in CVE-2026-22751.", "justification": "code_not_present" } }, { "id": "CVE-2026-22753", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d6e76a75-bc6e-53ec-8396-c35a7198b927", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22753 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. Spring Security 5.1.5.RELEASE is not affected by CVE-2026-22753. The vulnerability requires PathPatternRequestMatcher.Builder, a class introduced in Spring Security 7.0+. Version 5.1.5 uses a completely different request matching architecture (MvcRequestMatcher, AntPathRequestMatcher, RegexRequestMatcher) where servlet paths are configured through direct method calls rather than bean configuration. The vulnerable code pattern cannot exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:83ae6ae7-3366-5a6d-96b4-bf89e308dd66", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. Spring Security 5.1.5.RELEASE is not affected by CVE-2026-22754. The vulnerability exists in version 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean where the basePath() return value is not captured, and HttpSecurityConfiguration doesn't use bean-provided builders. Version 5.1.5 uses a completely different architecture (MvcRequestMatcher with property setters instead of PathPatternRequestMatcher with builders), and the servlet-path feature has worked correctly since its introduction in Spring Security 4.1 (2016).", "justification": "code_not_present" } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:da81e7e5-807e-55d5-b26c-ff54cdbb29a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:743d5863-a067-5b2c-90f3-8928a0e4983b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 5.1.5.RELEASE does not contain the InetAddressMatchers utility class that is the subject of CVE-2026-59277. The vulnerability concerns the matchInternal() and matchExternal() builders of InetAddressMatchers failing to recognize 0.0.0.0 and :: as internal addresses. Exhaustive search confirms this class, its methods, and the org.springframework.security.util.matcher package do no...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ] }