{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d22d3809-a896-5cbb-b041-7060158920da", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-oauth2-client", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1", "version": "5.1.5.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-oauth2-client", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE", "type": "library", "group": "org.springframework.security", "version": "5.1.5.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:75f67764-1317-57be-a2d3-97909395cedd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a42210ee-519a-5790-9739-d061b2090215", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2f3ed65b-4693-591a-982a-cce29d535c5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1f158066-b18d-53cb-9f14-99bcd77ca968", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d9484ccc-9e24-5908-97e9-6d2ae95b8238", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8d8efd8b-61bf-5818-84ac-e9695211befb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7732da72-0800-5234-b820-040dce988635", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7b1c0793-eeb2-5f87-9436-cde394aa04c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fb51977e-5dde-5a5a-9b9e-c2ec096b5b61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f389ed07-0344-537c-bc99-0b4b70c4e4dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2a77abef-4b38-542b-8e35-4098f7b09d6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2c5383e8-31ec-565c-ae24-4410bc21748a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:27afb875-547c-5e65-9469-b8d9d5d1969a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:96283638-2759-529d-8b97-d2e96fbca5b5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-3795 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client. not_affected \u2014 The target repository (Spring Security 5.1.5.RELEASE-tuxcare.1) is NOT AFFECTED by CVE-2019-3795. The vulnerability involved insecure randomness when SecureRandomFactoryBean#setSeed was used to configure a SecureRandom instance - specifically, calling setSeed() before any random bytes were generated would cause the user-provided seed to REPLACE the entire internal RNG state rather than suppleme...", "justification": "code_not_present" } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cefee175-2465-5715-b11f-c32a4c7c86c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:12c3398e-008a-5155-a6f2-fea112e1be8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3f31fd8f-1392-5fc8-93a2-b9124448b814", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ddf79134-799d-5631-b65b-fa3621c333a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:54abba40-9ee1-51d6-bb73-01a8b05f4c06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3b1d0212-bf17-507d-a740-45dddcc9fbcc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2022-31690", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6be98441-8ded-5acd-992b-1b41fc99941c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31690 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0d6d02aa-5f86-5c72-be52-a53b7b73d1f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:433dc06b-e5a2-573d-8b7d-4c0e06b8bec3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3fcedc6e-bf11-5ce4-9059-7ea3f8876a2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:173b6091-9f90-510d-8ce3-c504eacb296e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5f2c4ed1-ffe2-570b-add0-1eda0a019183", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a9a36a3d-86c7-578f-8647-d2337f4f45ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9e1ad64b-fc68-5c74-8b99-fd2b4c638a7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:16aff201-be25-5dd0-a7de-aafc0d8872ae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client. not_affected \u2014 Spring Security 5.1.5.RELEASE is not affected by CVE-2025-22223. The vulnerability requires @EnableMethodSecurity and the UniqueSecurityAnnotationScanner class, both introduced in Spring Security 6.0.0. Version 5.1.5 uses @EnableGlobalMethodSecurity with PrePostAnnotationSecurityMetadataSource, which relies on Spring Framework's ClassUtils.getMostSpecificMethod() to correctly resolve annotation...", "justification": "code_not_present" } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2a35b7c1-ab47-5387-b5d2-0f55040aeaa8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client. not_affected \u2014 Target version 5.1.5.RELEASE is not affected by CVE-2025-22234. This CVE fixes a timing attack vulnerability introduced by CVE-2025-22228, which added an unconditional 72-byte password length check that broke timing attack mitigation in DaoAuthenticationProvider. The target does not have CVE-2025-22228 applied, therefore it cannot have the timing oracle vulnerability that CVE-2025-22234 address...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d022753c-473d-5f90-9c1d-f1f9b30eed92", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.1.5.RELEASE does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e5e91fa4-18a9-501f-8e68-f4bd4d2ff36f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.1.5.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c0789c05-ce51-5402-adb7-c9cff64b19ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6c040d06-acfb-552e-bcf1-26775591dd10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:96810662-c73f-5c32-bdda-0c7b758611c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5b96601f-e9c0-5c83-8b97-7e9d82297e76", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client. not_affected \u2014 Spring Security 5.1.5.RELEASE does not contain the One-Time Token (OTT) authentication feature. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.3.x, several major versions after 5.1.5. The target codebase does not process one-time authentication tokens and therefore cannot be affected by the TOCTOU race condition described in CVE-2026-22751.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:eb8e03fa-43c9-5c7f-82ea-f929a4476532", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client. Spring Security 5.1.5.RELEASE is not affected by CVE-2026-22754. The vulnerability exists in version 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean where the basePath() return value is not captured, and HttpSecurityConfiguration doesn't use bean-provided builders. Version 5.1.5 uses a completely different architecture (MvcRequestMatcher with property setters instead of PathPatternRequestMatcher with builders), and the servlet-path feature has worked correctly since its introduction in Spring Security 4.1 (2016).", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:96072933-8c5c-5e3c-8d3c-1589f0f41225", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41706 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client. not_affected \u2014 Spring Security version 5.1.5.RELEASE is not affected by CVE-2026-41706. The vulnerable classes (CookieRequestCache and CookieServerRequestCache) that store pre-authentication redirect URLs in cookies do not exist in this version. These classes were introduced in version 5.4.0-RC1 (commit 9708a2d63f). Version 5.1.5 only has HttpSessionRequestCache (which stores requests in HTTP session, not coo...", "justification": "code_not_present" } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:80e8817b-12d7-5bc0-9d46-2339e79f30b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47838 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1dbc4801-5681-5406-adb7-bc65b115d066", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 5.1.5.RELEASE contains no WebAuthn code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:30dbaa91-4ec8-545c-ad3e-1d8d5fe5f0ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1047b800-5bab-5392-bcca-13a6985a6885", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-client. not_affected \u2014 Spring Security 5.1.5.RELEASE does not contain the InetAddressMatchers utility class that is the subject of CVE-2026-59277. The vulnerability concerns the matchInternal() and matchExternal() builders of InetAddressMatchers failing to recognize 0.0.0.0 and :: as internal addresses. Exhaustive search confirms this class, its methods, and the org.springframework.security.util.matcher package do no...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@5.1.5.RELEASE-tuxcare.1" } ] }