{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:31b0851e-6188-5ec6-b8a7-2d00409a2725", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-oauth2-client", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6", "version": "6.2.8-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-security-oauth2-client", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8", "type": "library", "group": "org.springframework.security", "version": "6.2.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:f3975c26-153d-5409-a875-b5e5468a6cb7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:4cba783b-a916-58e1-b0ad-1f2b08059932", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:760f9a67-013a-53ba-b8e4-87549750ac14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:ebdd3ca0-5055-5205-aeb7-504eb4d49719", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:66631243-6c65-5185-b4cf-7190b3d92fab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:ec91e79a-ac71-57dd-a645-e68e74dabc10", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:bbf92591-ce8c-50fc-98ed-66d302e454f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:dc1ef313-f561-5c1a-9362-61d5a751585c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:ecb7e5e0-fe21-54d6-b4e2-c0972cad7b2f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:f7092642-be52-55cf-8364-22301296a523", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:fb7850df-6ec7-5403-aeb2-0241fb23c4f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:3ea24bfe-bebc-58bb-8c06-1fbc05c0a5a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:67d38ce6-32b5-51a8-a557-acfc8820e671", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:ab766054-a59c-5530-af1d-af312375a4d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:859064bc-0bdc-54c2-b8e3-9ea808b3ad8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:7b30da85-3236-5afe-843c-2dddc4898d5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:24754e86-b567-5b24-bdcd-5e0ed6769947", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:f7ae5826-4d24-5388-8c18-d74dc8be0077", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:c9f2bdbc-d75d-54e5-af18-14ca03f6a12e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:f674fdc9-807e-5a5a-95ca-8c2165dad2e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2022-31690", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:83e56de5-d06a-5e29-9862-ea14c4fd53a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31690 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:a3f0de8b-4499-5c04-bf63-41c5dd497c86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:cdd6c2e1-e5d1-5383-ae1c-130236faa34f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:bdb880a5-c282-5d22-b40d-000e62b8a416", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:c5871e7c-ca04-5bf9-ad7e-ee53d8a3c299", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:79f535b2-8c1b-5bd2-ae7e-0d8c8f5dbacf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:5d17262b-a01d-573c-98e8-40067c961745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38821 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:2a2cb6c9-eef5-571b-9666-6174bad3fc17", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:1ee9118c-9c7a-5b38-9cd3-11d710d579b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:650f82f5-fead-5e0d-8628-e62203ae1bb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:ae650f42-52c7-5bc1-b7b8-05173969aa0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:accf6d9e-e4d5-552c-ba21-d12605b5c8ca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client. Spring Security 6.2.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:46badc49-9108-50e5-b7a0-c5e5f2dddd35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:fdf55279-9d89-5157-824b-151aeb7c77a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:b5a80c11-987c-5d73-89b7-2852dd2ef9da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:789d7248-0abf-54b1-af35-9e7326f1d153", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22747 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:f185ee30-fc57-51a4-ac0f-6b5600b6064c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client. not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService) and the entire OneTimeToken authentication feature were introduced in Spring Security 6.4.0, which is a later version than the target 6.2.8-tuxcare.6. The feature does not exist in this codebase, therefore the TOCTOU race condition cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:32c3bda1-2419-5f2a-bff3-36d7b24242c9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client. not_affected \u2014 Version 6.2.8 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean, a class that does not exist in version 6.2.8. Version 6.2.8 uses a completely different architecture (MvcRequestMatcher with property setters) that correctly handles servlet-path configuration without the builder reassignm...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:648057aa-04cf-5bb6-9311-327ad9774c87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:558360d7-b5e7-5e01-84ff-c2530f20a920", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:3537bd56-f788-5e90-9fcd-81207bcbc370", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47841 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:01072bbc-34d3-5008-b1ea-fb471767b92b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:4aa10d96-8af3-54f6-a419-bac14adcca3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:c0d730cf-ac59-5b77-be84-b96271ca00a5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-oauth2-client. not_affected \u2014 Spring Security 6.2.8-tuxcare.6 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class with matchInternal()/matchExternal() builders) does not exist in this version. The CVE affects a utility class that classifies IP addresses as internal vs external for access control purposes, but this functionality is not present in 6.2.8. The existing IpAddressMatcher class s...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.8-tuxcare.6" } ] }