{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d883c14e-3219-5766-8fb9-2a636e3534c0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-config", "purl": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1", "version": "5.1.6.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-config", "purl": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE", "type": "library", "group": "org.springframework.security", "version": "5.1.6.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ab9a58d2-25c7-5cff-9190-67d0b5d5d16e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:934ce9a7-4b1c-5f2e-bbec-be5b2a81f717", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9a87013e-0ef8-5bb7-9ac0-fae927780ef9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c269fb00-43e4-50c8-9fe5-11366e7ba8c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:083d6143-e526-5269-9a2b-f64156398985", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:675be9e7-7041-5a44-badf-96c010190c86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:dd41a4f1-2d9e-5f2a-8ee3-871923a24f0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f87b6c7a-3622-5b01-a45f-bf5dae8583fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:21855b2d-abaf-53bd-bf3b-14800d1c7488", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cb952479-b2bb-51ec-99df-7e12169dce6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:83e6112c-c883-5fb3-943c-a1cf2ab17915", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d1176ac2-088b-591d-83aa-5159411ec495", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d7bf6c58-3fcc-5249-90cc-58e42f869eb7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c897ef0d-bc11-530e-88c4-effa36315895", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c1969b47-e21b-519f-954a-48f1be100cea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f4e9ef49-efa1-54e2-9acf-62b6554d49b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bc9dd5ce-b070-543d-93d7-22e96ddfe82a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:119a31d0-7455-52da-a594-c7e35254940e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:178dc9d2-9c84-548c-802a-ec36a4c13546", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a8987cbe-121e-5d7c-8956-7a8793b23027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1e75cce9-cc83-53e4-9fc7-93474b486214", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2023-34034", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2c02d284-48b2-5dbd-8ef4-368b001f21a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34034 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2023-34035", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b72bc58a-41e8-5a5f-9ce3-7df21a892c41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34035 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2023-34042", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:492dd69d-f306-5dbd-99da-e560acc4094d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34042 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. not_affected \u2014 Version 5.1.6.RELEASE is NOT AFFECTED by CVE-2023-34042. The vulnerability involves a world-writable spring-security.xsd file caused by a symlink in the source tree. However, this symlink was introduced on 2023-05-19 in versions 5.7.9 and later, and never existed in version 5.1.6.RELEASE. The problematic file spring-security.xsd does not exist in the target repository at all. All XSD files pres...", "justification": "code_not_present" } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:88ae3a13-a366-5712-bff5-3282d36803f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b7f9ae01-6a49-57b5-9ce6-a17d2cebd08a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:75c96693-d935-57cd-be66-e864f799899f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cf681dd6-2b66-50e0-b97f-e8ca5a13fe03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ce44a952-d21c-54f3-8976-0699caa364f4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 5.1.6.RELEASE does not contain the vulnerable code. CVE-2025-22223 specifically affects applications using @EnableMethodSecurity (introduced in Spring Security 5.6+), which resolves method security annotations via UniqueSecurityAnnotationScanner. Version 5.1.6 uses the older @EnableGlobalMethodSecurity API with PrePostAnnotationSecurityMetadataSource, a completely different impl...", "justification": "code_not_present" } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:45e69c48-efad-578d-9f1b-2466fbd7a750", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. not_affected \u2014 The target spring-security 5.1.6.RELEASE is NOT affected by CVE-2025-22234. This CVE addresses a timing attack vulnerability that was inadvertently introduced by the CVE-2025-22228 fix. However, 5.1.6.RELEASE never received the CVE-2025-22228 backport, so the vulnerable code pattern (unconditional 72-byte password length check in BCrypt.hashpw that breaks DaoAuthenticationProvider's timing atta...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:12b62c3a-eb5d-529f-8005-6aee48a9e06b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.1.6.RELEASE does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:dc41ff33-495f-5875-a010-1d8caa014ead", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.1.6.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:00d1914f-cff3-5974-97d8-07f431d356d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:677f6ba8-aadb-5996-87e8-b4ba52a50395", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) was introduced in Spring Security 6.4.0-M4 (July 2024), long after the 5.1.6 release. The target version does not contain the vulnerable code, cannot process one-time token authentication requests, and lacks the authen...", "justification": "code_not_present" } }, { "id": "CVE-2026-22753", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2f0c7ea9-ad3e-57ad-8f64-ad1c96f8f4fb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22753 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. Spring Security 5.1.6.RELEASE is not affected by CVE-2026-22753. The vulnerability affects versions 7.0.0-7.0.4 and involves PathPatternRequestMatcher.Builder bean discovery and basePath assignment failures. Version 5.1.6 predates the PathPatternRequestMatcher architecture entirely - it uses the older AntPathMatcher-based request matching via MvcRequestMatcher with direct servlet path setters, not the builder pattern introduced in 7.x. The vulnerable code pattern does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:deaaeac8-ae75-50da-aba9-4b2d2513f4a5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. Spring Security 5.1.6.RELEASE is not affected by CVE-2026-22754. The vulnerability is architecture-specific to version 7.0.0-7.0.4's PathPatternRequestMatcherFactoryBean, which uses an immutable builder pattern where the basePath() return value was not captured, causing servlet-path authorization rules to be silently ignored. Version 5.1.6 uses a completely different implementation (MvcRequestMatcher) with direct property setting via setServletPath() - no builder pattern exists. The servletPath property is correctly set during bean construction (via BeanDefinitionBuilder.addPropertyValue for XML config or direct setter calls for Java config) and is properly checked at runtime in MvcRequestMatcher.matches() lines 67-70, blocking requests that don't match the configured servlet path. Tests confirm servlet-path authorization works correctly in 5.1.6. This is Rule 5 Type B: alternative defense present at runtime.", "justification": "code_not_present" } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c0166cd6-d51c-51fc-b295-5a58e271e737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5f9cc65e-a7a8-5718-b490-7d0a2e528518", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-59277. The vulnerable component InetAddressMatchers (with matchInternal() and matchExternal() methods) does not exist in this version. The class was introduced in later versions of Spring Security. Version 5.1.6 only contains IpAddressMatcher, a CIDR-based subnet matcher without internal/external IP classification capabilities,...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1" } ] }