{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:925f0c0f-6cb2-56c4-a101-03d600f414f6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-config", "purl": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2", "version": "5.8.14-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-config", "purl": "pkg:maven/org.springframework.security/spring-security-config@5.8.14", "type": "library", "group": "org.springframework.security", "version": "5.8.14" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2007-1651", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:152f2ac7-efe3-5848-bf87-97190fe208bc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2007-1651 does not affect version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config. not_affected \u2014 CVE-2007-1651 describes a CSRF vulnerability in OpenID implementations where cached DiscoveryInformation tokens persist in the HTTP session after logout, allowing session restoration attacks. The upstream Spring Security project fixed this vulnerability in commit f5468087c2 (April 2010) by adding session cleanup in the endConsumption method. The target repository (Spring Security 5.8.14.tuxcare...", "justification": "code_not_present" } }, { "id": "CVE-2007-1652", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:c3972a63-9712-535f-87fd-b77322c7c1ea", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-config 5.8.14-tuxcare.2. CVE-2007-1652 is a vulnerability in JanRain's myOpenID hosted service, on the OpenID\nProvider side. It does not apply to Spring Security in any version.\n\nNo affected software product is on record. The CVE record carries vendor \"n/a\", product\n\"n/a\" and version \"n/a\"; NVD lists a single unversioned CPE, cpe:2.3:a:openid:openid:*,\nwith no version bounds; the GitHub advisory GHSA-3x88-xvgr-m6fg is unreviewed and lists\nno affected package in any ecosystem; OSV has no entry for any spring-security artifact\n(control: the same query returns 5 entries for spring-security-config and 31 for\nspring-security-core); and spring.io publishes no advisory for this CVE. Every one of the\neight references points to JanRain's myOpenID security-fix announcement of March 2007 or\nto the openid.net security mailing list threads of the same month, where the reporter\nstates the problem had to be fixed on the myOpenID server.\n\nThe reported mechanism is Provider-side by construction. A crafted web page uses a cached\nauthentication token and an existing Provider session to forcibly log a user into an\nOpenID-enabled site, release the user's personal information to it, and silently add that\nsite to the user's trusted-sites list. A trusted-sites auto-approval list exists only at\nan OpenID Provider; a relying party has no such list and no auto-approval step at which\nthe flaw could occur.\n\nThe openid module of Spring Security implements only the relying-party (consumer) role.\nOpenIDAuthenticationFilter drives the two-leg consumer flow and OpenID4JavaConsumer wraps\nopenid4java's ConsumerManager. The only openid4java packages referenced in the tree are\nconsumer, discovery, message and association - there is no use of org.openid4java.server,\nno ServerManager, no OpenID Provider implementation, and no trusted-sites or auto-approval\nhandling of any kind. No openid4java sources are vendored into the tree.\n\nNor could this library have been affected when the issue was disclosed: the CVE was\npublished on 24 March 2007, while the earliest OpenID code in the project dates from\n20 April 2007 and only reached the shipped openid module in January 2008.\n\nResolved consistently with spring-security 5.6.10 (VPV 9976), 5.7.11 (43741),\n5.7.12 (12031), 5.7.14 (40534) and 5.8.16 (330), all closed as false_positive." } }, { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:12328b27-ab96-5aae-9cb0-b8bff93f7b8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:093913fa-5d06-5fc4-9dec-c35633beb55f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:5034eff7-05d3-51d0-a8af-fe88fd4beca4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:2c8b5a16-f768-55c1-9133-8fdfe4cf01fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:9b5642c8-9cdc-54c9-9551-abe1ee6b83c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:edf6c4cc-96d9-5a0a-8ef7-e72ec247f474", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:d4e90cea-f0e9-5d05-98bd-71552f59f2fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:478abe89-b407-5308-a30d-87903ab37ed0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:d39c32a5-ebf6-545d-8e6b-64896893e92e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:66ca8207-fe22-5646-88fd-bab933797fe9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:8d5f9c99-15a4-55fb-ad9e-2b2097aa1cac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:614eba58-d184-504b-a68f-8d9ac83267d0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1258 does not affect version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config. CVE-2018-1258 affects Spring Framework's AspectJExpressionPointcut class, not Spring Security itself. The target (Spring Security 5.8.14) does not contain the vulnerable code - it exists only in the Spring Framework dependency. Spring Security 5.8.14 uses Spring Framework 5.3.39.tuxcare, which was released years after the fix (Spring Framework 5.0.7, June 2018) and contains the upstream patch. The vulnerable code pattern (annotation matching failure on proxy classes) is not present in Spring Security's codebase.", "justification": "requires_dependency" } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:80c53df1-f76e-5357-8aea-e30cdd635e76", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:4e7f52bf-d5e1-5ecb-9b7d-44ee7235540e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:34f21590-106d-53b7-994b-cbe803e3df38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:5e3b2f9f-83ed-5583-90b2-c00f1f8d64e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:db2022f6-f31f-53d5-853c-af7e579b3bc0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5408 does not affect version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config. not_affected \u2014 CVE-2020-5408 is not affecting this target. The vulnerability involves using a fixed null initialization vector (IV) in the queryable text encryptor, which enables dictionary attacks on encrypted data. The upstream vendor (Spring Security) applied their fix strategy by deprecating the vulnerable queryableText() method in commit db155b3094 (April 2020). This deprecation with security warning is ...", "justification": "code_not_present" } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:dc3e4da1-1c77-5dd0-bd57-f7895f81f308", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:42c6cb16-40f3-5781-b0c8-5c5ddbfe80a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:66c4c6cc-0167-5301-99a9-86e938c3cd05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:7cf27059-e77b-51b1-a0a0-225216a6d83f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:23411cf9-a560-5e55-acc9-59f558f7a417", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2023-34034", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:3927849f-275d-5d2c-86f2-633f4144c112", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34034 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2023-34035", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:c818ee9c-5b6d-51c7-89e2-70ff12a0443f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34035 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2023-34042", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:c0f4b2c6-a954-53a3-b46d-bec0e8b647d1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34042 does not affect version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config. not_affected \u2014 The target Spring Security 5.8.14.tuxcare is not affected by CVE-2023-34042. The vulnerability involved a world-writable symlink (spring-security.xsd) that was packaged with incorrect file permissions. The upstream vendor (Spring Security) fixed this in version 5.7.11/5.8.7 by removing the symlink and implementing automated build-time generation using proper Java NIO operations that preserve co...", "justification": "code_not_present" } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:3c33b8dd-0052-59b1-af42-aaab07756ff0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:c91a2690-f69a-502f-8f0b-9cfb87d803f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:ca1ccb90-abc6-5749-ad9d-c6a8e17b110b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:f25ad277-ed94-562e-95ea-ab803515fd3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:131364bc-9a7b-5e45-b58e-53714dea88e9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config. not_affected \u2014 CVE-2025-22223 affects Spring Security's UniqueSecurityAnnotationScanner class introduced in version 6.4.0. Target version 5.8.14 uses a different annotation scanning implementation (AuthorizationAnnotationUtils with Spring Framework's AopUtils.getMostSpecificMethod) and does not contain the vulnerable code pattern. TuxCare backported this CVE only to version 6.4.3, confirming it does not affec...", "justification": "code_not_present" } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:cc539021-63d1-5a4e-bddb-574fee51b65c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:7b0f62c1-6170-51fb-bf4b-58674c8c0e0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:5d853da2-35d2-557a-94f5-f88fe3506bb0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.8.14 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:08b06e85-c902-5224-ad90-ffd1dd914941", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config. Spring Security 5.8.14 is NOT AFFECTED by CVE-2025-41248. The vulnerable class UniqueSecurityAnnotationScanner does not exist in this version. The CVE describes an authorization bypass in Spring Security's annotation detection mechanism when using @EnableMethodSecurity with security annotations on methods in generic superclasses/interfaces with unbounded generics. However, this vulnerability was introduced in Spring Security 6.4.0 (August 2024) with the new UniqueSecurityAnnotationScanner class. Version 5.8.14 uses a fundamentally different annotation scanning mechanism (AnnotationUtils.findAnnotation from Spring Framework) that has been stable for years and does not have this generic type resolution bug. TuxCare applied the CVE fix only to version 6.4.3+ (commit 625768ebab), confirming 5.x versions are unaffected.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:2d7d023c-dd1b-59de-b57b-e5acd0070a79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:22782d19-4224-507e-9b93-a32ed96a2ebb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 5.8.14 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire OneTimeToken authentication feature) does not exist in this version. The OneTimeToken feature was introduced in Spring Security 6.5.x on 2025-02-05, approximately 6 months after the 5.8.14 release (2024-08-19). Exhaustive searches found no OneTimeToken-related code, classes...", "justification": "code_not_present" } }, { "id": "CVE-2026-22753", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:bcd8b750-d7af-512c-ad57-dc45b529cd46", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22753 does not affect version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config. Spring Security 5.8.14 is not affected by CVE-2026-22753. The vulnerability is specific to PathPatternRequestMatcher.Builder functionality introduced in version 7.0.0. Version 5.8.14 uses a different request matching architecture (MvcRequestMatcher/AntPathRequestMatcher) that does not have the vulnerable code patterns. The CVE affects versions 7.0.0-7.0.4 only; 5.8.14 predates the introduction of PathPatternRequestMatcher entirely.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:4fe08cb8-501a-5ef4-a73f-ac7209e673e1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config. Spring Security 5.8.14 is NOT affected by CVE-2026-22754. The vulnerability exists only in versions 7.0.0-7.0.4 and is specific to the PathPatternRequestMatcher architecture introduced in version 7.x. Version 5.8.14 uses the MvcRequestMatcher architecture which correctly handles servlet-path configuration through property injection and mutable builder patterns, with no builder return-value capture bug. The authorization bypass described in the CVE cannot occur in 5.8.14's architecture.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:ed3a2081-fd90-57fe-a4ac-317731765be4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47842 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config, and is fixed in 5.8.14-tuxcare.3." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:dffb397e-5150-518c-bfce-5397ccb0c1bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config, and is fixed in 5.8.14-tuxcare.3." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ], "bom-ref": "urn:uuid:54b1f425-fc91-5c35-a356-57bc654cef06", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.8.14-tuxcare.2 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 5.8.14 is NOT AFFECTED by CVE-2026-59277. The vulnerable class `InetAddressMatchers` and its `matchInternal()`/`matchExternal()` builder methods do not exist in this version. This functionality was introduced in a later Spring Security release. The target version lacks the entire `core/src/main/java/org/springframework/security/util/matcher/` package where the vulnerable class r...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.8.14-tuxcare.2" } ] }