{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6f6ba668-98da-5524-bfed-569dc730c3d1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-oauth2-client", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2", "version": "6.0.7-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-oauth2-client", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7", "type": "library", "group": "org.springframework.security", "version": "6.0.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:4c06eb3c-ae39-5ab0-b04e-c6532d58b063", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:24840ce1-1ef3-5328-a2cc-b9fdd67d006c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:fe7e842e-c33f-5801-8ede-0c36564f4fdb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:d9164f16-2736-5d81-b572-ba57610ea5ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:fc95f617-eb03-5eca-900d-e4697d0e8934", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:10f5fd25-b299-5713-a903-b385364a8404", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:9784a6c3-21ea-570a-9094-51a6cd9010b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:9b23389c-917e-51a9-947f-98be2381bc98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:6723a2a4-26c1-5fb0-8e0f-447d42472ac8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:e165c982-c4d1-51b5-89ff-a223b684bb7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:4c5ff1e5-15bd-5e45-8a98-c65da688057e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:e290fa57-1fef-57d4-837a-497e2b1155c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:ac8803be-742e-51de-9200-d8f7cf600d9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:631242d7-3636-5eed-9429-f0a5d5dcfcb3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:eed80c03-f548-5355-9271-665693134a2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:07e97a37-fc37-5ef1-b25d-15aaf9ed99bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:3d87d8b7-5f57-5990-96f8-c5a1bfac479b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:5e3d3e56-854d-51bf-b43c-af048b0ebd2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:14861f1b-3251-58ed-a309-1dfbe3a11748", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:91805b89-309a-531c-99cb-59e8c904b06d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2022-31690", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:10e24721-c57b-5bc6-81c3-d7c3f53d4ee3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31690 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:25b5ca6a-7f63-55cf-a1b8-50bfcb40174e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:a3543673-187c-5fdf-9616-266ce8a7fb1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:90e4ff2a-2688-52f3-b012-c5d8c586a70d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:00730218-a8a6-5748-98f7-532b91eb4570", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:91c69c0a-57e1-5769-a97c-d2b71a397810", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:c9e25003-70f5-508d-8b0f-cb380f9d6645", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:e01737e7-2f12-5287-8cff-c43680188ff9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:c3c4bccf-43c1-59c1-8ef1-9399dbf87cb5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:23bd111d-f9c9-5706-97ff-753dda84e78b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:5f502a57-0815-5319-8df3-8df07bfed653", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:be05f30d-1cfc-5d22-a253-2c3d1aa50c09", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 6.0.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:28659cda-1a6f-5a73-9861-7fff3bef3674", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client. Spring Security 6.0.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:d022dea6-f4b4-5815-92ea-864ea911aa1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:301700c8-fe39-55d8-8bc7-69cd91e91ccf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:9ca4b78e-70d7-5e70-ad56-6cfab3e39c74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:83ee8c22-b8c5-559d-be9c-4f52d201cc07", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client. not_affected \u2014 CVE-2026-22751 does not affect Spring Security 6.0.7. The vulnerable component (JdbcOneTimeTokenService) and the entire One-Time Token (OTT) authentication feature were introduced in Spring Security 6.4.0-RC1, which postdates version 6.0.7 by several minor versions. The target codebase contains no OTT-related code, classes, or interfaces. This is a Rule 5 Type A1 case: the INPUT type (one-time ...", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:07192bc0-8e1a-529f-aecf-38ec10d48264", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client. Version 6.0.7 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcherFactoryBean (introduced in Spring Security 7.0.0) where a builder reassignment bug causes servlet-path configurations to be ignored. Version 6.0.7 does not contain PathPatternRequestMatcher or PathPatternRequestMatcherFactoryBean. Instead, it uses MvcRequestMatcher for servlet-path support, which correctly handles the configuration without the builder bug. The CVE's affected version range (7.0.0-7.0.4) is accurate; this vulnerability was introduced with new functionality in 7.0.0 and never existed in 6.0.7.", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:903d01ea-a914-5286-85de-f9a59d6734de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:ded21bf2-9a17-51b1-981b-03ea100824cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:f91af3e0-5d3b-5330-9760-d6e0e3f85eca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47841 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:309362da-e122-509b-a668-b303978cad6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:f6ef3b0a-fc8c-5dd5-b3fa-36a00206d111", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:cb524566-acc2-504f-8176-fcda1f654333", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client. not_affected \u2014 Spring Security 6.0.7 is NOT AFFECTED by CVE-2026-59277. The vulnerable component `InetAddressMatchers` and its `matchInternal()`/`matchExternal()` methods do not exist in this version. The class was introduced in Spring Security 7.1 (confirmed via upstream @since annotation), several major versions after 6.0.7. While version 6.0.7 processes IP addresses via `IpAddressMatcher`, this class only ...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.0.7-tuxcare.2" } ] }