{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d64324f3-9401-549e-af8a-24a0a1cd7e6e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-config", "purl": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6", "version": "6.2.8-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-security-config", "purl": "pkg:maven/org.springframework.security/spring-security-config@6.2.8", "type": "library", "group": "org.springframework.security", "version": "6.2.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:2e41c9ae-2906-5876-9bcd-bb4d8ac8b5d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:5968bbe7-cc72-5ea9-beb5-6baf92a21e88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:0b946688-b3a1-5562-a0ed-c2d7a9b29c9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:d8f4c635-df25-5811-834e-1a3ed02bf254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:00c90af7-f1cf-5ced-8f07-a98d1b1cdc68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:4380a9e5-481d-5db5-bd83-86f3eddd7d5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:4325c1e4-e63f-56b0-aa61-9a90c597d300", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:75278c84-9423-5919-ac54-5a4e8d3db041", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:78a83122-4219-5bd5-8062-fe20aac7f6cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:144c2362-fa04-5618-906f-7baf50518cac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:96238ec5-1ac5-59e8-bf48-8b96ca147b4e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:fa49d740-17a8-5cd4-9497-41671e763abb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:819f251e-9a58-5c9a-b8e1-5a505b2b4485", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:6fdf3de7-7bf7-5b1c-afdc-6006aaceb433", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:93468c52-2fd4-5880-a6c5-dd936fe254e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:fc67f9cf-21cd-5136-a162-531579daeedc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:cec0b8dd-a41c-5924-aa31-6db62a7f9b53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:d047ec3a-3a38-50a7-b0cf-0789f1bfd0c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:a1ce0026-0437-5f50-bede-ee4f4cc9cd31", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:b9672d90-ddb9-55a2-95d9-cae2d5d9cd67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:8167ad03-78da-5e1f-940d-9cae2cee1132", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2023-34034", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:24abc0d9-800d-5198-9268-c7a8dc68bd96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34034 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2023-34035", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:1fefdb53-5844-569d-b008-a918e7d92863", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34035 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2023-34042", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:850c6896-81ba-5d69-b7de-8ab94abff6f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34042 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:aebb2c30-8345-589f-8ce2-ded08d500208", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:0ae622ba-4690-5896-bb20-092013874c48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:84438372-5c11-55ac-96cf-2568f9b3179b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:9322597c-1a07-5cf0-a4c8-e3b0634f428a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:3f5eff66-ea75-5def-bdc9-5a9266ed0a9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:1df7458e-e00d-537f-ad29-7de1fd9477ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:37bacbcf-3a31-517a-9eec-bf459ab9425a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:8bfdf30b-0a66-5b81-b320-634f87350569", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config. Spring Security 6.2.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:b67b5584-bd35-565f-953b-875ab9301073", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:65c29012-e69c-5e30-9a89-9552b07c160e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:c483a4b8-939d-5e01-ac77-56362a8afc76", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService) and the entire OneTimeToken authentication feature were introduced in Spring Security 6.4.0, which is a later version than the target 6.2.8-tuxcare.6. The feature does not exist in this codebase, therefore the TOCTOU race condition cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2026-22753", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:27fdd0c7-7342-5cbd-8245-3e7df81021ae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22753 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2026-22753. The vulnerability is specific to PathPatternRequestMatcher.Builder functionality introduced in Spring Security 7.0.0. Version 6.2.8 uses a different request matching architecture (MvcRequestMatcher and AntPathRequestMatcher) that does not contain the vulnerable code pattern.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:79efb0be-1142-5774-9ce2-c1c4ccfaefa5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config. not_affected \u2014 Version 6.2.8 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean, a class that does not exist in version 6.2.8. Version 6.2.8 uses a completely different architecture (MvcRequestMatcher with property setters) that correctly handles servlet-path configuration without the builder reassignm...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:baf5c280-500a-5e6b-a86b-2d4ef6691084", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:41f0c0c1-371b-50de-8a80-d62258568cda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:b4c5c711-84a5-5727-bd6d-9e50bdf354a1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 6.2.8-tuxcare.6 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class with matchInternal()/matchExternal() builders) does not exist in this version. The CVE affects a utility class that classifies IP addresses as internal vs external for access control purposes, but this functionality is not present in 6.2.8. The existing IpAddressMatcher class s...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.6" } ] }