{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5d87894d-5d01-5e35-9aba-f3d0991e96d1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-data", "purl": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1", "version": "5.1.6.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-data", "purl": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE", "type": "library", "group": "org.springframework.security", "version": "5.1.6.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:759c0839-5a4d-5a4c-b90d-db1201c02dbc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:dd8e462d-9b0f-549a-834c-97161e123a11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:abe42efe-b418-513c-9f53-0e3cd6bad898", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9d659f5f-9d62-5318-9c00-f6597c52bef7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:29fd80f5-41f6-50fa-954b-7844b0f65fdc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b49ca2b4-b6a4-52de-8963-a8c96190824f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:06382086-e014-5e44-8d8b-70233eb5b3a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:562949cc-dcb8-57de-86c5-d3ef47079d87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8f520add-4db9-5a4d-9c2e-ec1215bd61f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7345c4a4-ac33-57e7-8359-c396ac71aebd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0281e196-90d0-59d1-bcc9-599a2d6e6923", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8bba69db-0027-5d0b-a0d4-404253d78f73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d083c998-cbff-5fc2-b971-d305f0d0cc52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f9d21ee4-91db-5f4a-8560-a363e79077e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8da225be-16a0-5a00-82ee-041563589880", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:29f4eb12-4c5d-53ed-a6f5-925df26056d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1d23c7ad-26da-58f2-a2c0-da1aaaa7a882", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7e3a12ec-0c29-5db0-bc87-dfd2c4cfc313", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:54a02672-76b9-5477-bbc2-89e5c16f907f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ef4c11c3-478c-57f2-8b19-1c584ca594b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:87237f78-d626-598d-82a8-7c63e646d3d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:35d641ec-3337-5df7-9b9e-aa8561947bcf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4478b8f3-e102-5a89-85f5-2beef8862775", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6a831893-18f9-5687-a936-5a33c731fd56", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a8535a8a-dc19-5b6f-8ee7-1b62cd895df0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e69051a0-e63e-58a3-bbde-261afd0e2201", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security 5.1.6.RELEASE does not contain the vulnerable code. CVE-2025-22223 specifically affects applications using @EnableMethodSecurity (introduced in Spring Security 5.6+), which resolves method security annotations via UniqueSecurityAnnotationScanner. Version 5.1.6 uses the older @EnableGlobalMethodSecurity API with PrePostAnnotationSecurityMetadataSource, a completely different impl...", "justification": "code_not_present" } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2dd7a64f-3063-5233-9f40-a188ce3da767", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data. not_affected \u2014 The target spring-security 5.1.6.RELEASE is NOT affected by CVE-2025-22234. This CVE addresses a timing attack vulnerability that was inadvertently introduced by the CVE-2025-22228 fix. However, 5.1.6.RELEASE never received the CVE-2025-22228 backport, so the vulnerable code pattern (unconditional 72-byte password length check in BCrypt.hashpw that breaks DaoAuthenticationProvider's timing atta...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fa20fa56-dbf4-5c3d-ad6f-4a169af0dff6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.1.6.RELEASE does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:279a91cf-774e-5f0a-8f51-393912d8a52d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.1.6.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:87cb7c7f-a88b-550e-ae39-2ff908ffb15b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cba48d98-e2d6-52cb-93e4-c213e829076a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) was introduced in Spring Security 6.4.0-M4 (July 2024), long after the 5.1.6 release. The target version does not contain the vulnerable code, cannot process one-time token authentication requests, and lacks the authen...", "justification": "code_not_present" } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:eacb1788-f362-5562-9ffc-4543c6d61354", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:04913bd6-9da8-5572-bc73-ceb0b39fef36", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-59277. The vulnerable component InetAddressMatchers (with matchInternal() and matchExternal() methods) does not exist in this version. The class was introduced in later versions of Spring Security. Version 5.1.6 only contains IpAddressMatcher, a CIDR-based subnet matcher without internal/external IP classification capabilities,...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@5.1.6.RELEASE-tuxcare.1" } ] }