{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b0e08f35-2440-5d2d-ba0a-b9ad3b438118", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-oauth2-client", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1", "version": "6.0.7-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-oauth2-client", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7", "type": "library", "group": "org.springframework.security", "version": "6.0.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:78b1f70f-1184-5455-9d31-46b3992a7825", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:4358f2b4-3c8f-519f-9bdf-5ec58d37a43f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:eb8fdbb4-a18e-5064-b4ad-d4abbb1f0d87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:2db61d1f-97b3-5d14-bffa-83e8c48f77e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:da6b6a86-c88e-5b5c-9913-22bc4fe27194", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:5c3d4d1b-4dd9-574a-b281-69336215638e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:4873d4b1-a12c-51e5-9c62-60f40cd367f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:95921bf9-85e1-5125-8ed7-2bec9800e2cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:3722da4b-30ee-5df9-8342-78382d0fd9d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:9daaac47-68c2-5469-b1b4-0f3f09311f27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:31d41076-2783-5d52-ac85-b75583cff9ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:3d3af944-d383-5ae1-afd7-50f2e9c4a1b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:557b0e4f-aee3-5d2e-877f-f49cf0b395dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:f0b08d35-faad-5bf9-a9a7-bace8b3995ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:9e9c2842-73cf-56be-bd1d-40079a89ac0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:b10c94aa-0bb0-5c8e-be81-584cd31e8a4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:565ebaac-c314-5058-8ec8-ff4747eb87f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:0bc18d89-0987-505e-9260-c1db6da87dd4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:d94fe38e-32fd-5f0f-8436-5f1699bf04f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:d75f1163-dfbc-52f6-b331-65883a0582fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2022-31690", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:1286574f-af59-5772-a681-3c8f2fc92b49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31690 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:959787a3-9237-5dbd-b699-53d02b012c90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:2490667d-15a6-5808-8e2c-a2926c4b1e8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:1aaf521e-9e1a-52d8-924c-7e5194f95b60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:62b85dee-4f54-5db9-9da6-0c7a306c90fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:6926e58b-bf87-568b-85a2-1e0fef10b6e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:056a26ac-286e-5d94-843f-54be6ce609e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:5c04556a-56aa-5b00-92f6-2f9fd50ec876", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:270f38fc-3e38-5d54-a0fb-5f9c07940ec0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:940fda40-cbeb-5e71-946f-605ddde240e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:8d7cecc9-f88f-56d1-a20b-e47e979f0441", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:9e323b62-1bf9-561e-a602-c72325237d8c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 6.0.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:75d04dc1-4288-517d-aca1-1ac25ed400a2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client. Spring Security 6.0.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:2624ba6e-94b7-5652-a194-ed01b0535393", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:d9f99940-1e9a-58cd-9eb9-16a95f271c9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:b38c964c-35c1-5ec9-ab23-491cf01b276f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:113469fa-acf1-5a4f-b545-947e4e55aa7e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client. not_affected \u2014 CVE-2026-22751 does not affect Spring Security 6.0.7. The vulnerable component (JdbcOneTimeTokenService) and the entire One-Time Token (OTT) authentication feature were introduced in Spring Security 6.4.0-RC1, which postdates version 6.0.7 by several minor versions. The target codebase contains no OTT-related code, classes, or interfaces. This is a Rule 5 Type A1 case: the INPUT type (one-time ...", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:bde2a74b-4363-5198-9c42-e6801e6f9aee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client. Version 6.0.7 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcherFactoryBean (introduced in Spring Security 7.0.0) where a builder reassignment bug causes servlet-path configurations to be ignored. Version 6.0.7 does not contain PathPatternRequestMatcher or PathPatternRequestMatcherFactoryBean. Instead, it uses MvcRequestMatcher for servlet-path support, which correctly handles the configuration without the builder bug. The CVE's affected version range (7.0.0-7.0.4) is accurate; this vulnerability was introduced with new functionality in 7.0.0 and never existed in 6.0.7.", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:c75ebf65-3bf1-5e57-b802-fc7b375bb28b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:d3ff9478-03c8-5d5d-bc6b-26d71803afb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:7c8fa2f8-ab79-5935-8f02-2584cce28cae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 6.0.7 contains no WebAuthn code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:58878520-fee8-593e-906b-bde0d724a741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:a7a31610-3b81-5b4e-ae16-22e339a448d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:f4de0828-1f2a-5d65-93bc-a37902f6d7f8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-client. not_affected \u2014 Spring Security 6.0.7 is NOT AFFECTED by CVE-2026-59277. The vulnerable component `InetAddressMatchers` and its `matchInternal()`/`matchExternal()` methods do not exist in this version. The class was introduced in Spring Security 7.1 (confirmed via upstream @since annotation), several major versions after 6.0.7. While version 6.0.7 processes IP addresses via `IpAddressMatcher`, this class only ...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.1" } ] }