{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3dfe01a9-681e-5810-8166-3bdfdfbc2039", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-oauth2-client", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2", "version": "6.5.11-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-oauth2-client", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11", "type": "library", "group": "org.springframework.security", "version": "6.5.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:8713a45b-5cb4-56c9-b4b3-f681afd1f7b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:ba17ce92-04d3-5db8-8c95-5759e6443c20", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:70aaa572-7cdf-5fc5-ba33-79ab894d2b18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:acfec85a-f40a-5426-a99b-1f8321bca509", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:951d7ea2-a0d1-5196-9964-395ae620469a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:a2aabc6e-072a-5921-9741-1f753487dbb8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:cab71ac2-b718-5920-a4fe-d798cc48dfcb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:cbf7ac6c-d6a8-5705-b3ad-d82821e1771e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:bab29ac1-98a4-5aad-998d-bd42e7a6ae64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:137216f7-18f5-551d-b61d-f4153289d73c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:d27c4745-2883-526b-9057-5369a3d1d672", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:90cf3a15-f404-5b39-b01a-0441b65ffa9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:0501bf9b-926e-50a8-b7c1-76dd2c48066d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:ea5d793e-e534-507f-bb33-d2745c71fa43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:a7fcba38-b85b-5807-9e0b-5b5fef2821bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:24a97d20-1de9-5768-8fb6-4d1174bfaa0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:6d29a479-b5c5-5491-8c80-2ad92e9d7b99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:5b3450f6-cfb4-5276-8da1-aa562fa0d16c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:b0a64d92-2edf-5471-80bb-510c738870e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:5bce1cc2-2210-552d-92a2-fbbfeb009db6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2022-31690", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:e697028f-a970-5e8b-8c29-af112c9d503a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31690 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:6867a9a9-25b1-5b06-84e5-52889c650d42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:4e83662f-ea0d-5cfa-928b-0799d1f47bce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:da3f487e-82d9-54b3-abe8-fb0d22ea9dae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:73d10391-c611-5a66-ac15-7cb7f1b56d28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:5e5b5dec-7133-5bd1-8366-f0b0b25642bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:c4fcf455-35ef-5f5c-a2fa-a3484288ffd7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38821 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:98b4d545-a626-5445-88fb-ea628d5d860f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:0485abf0-a65b-5185-b31c-f6ddba1c5e02", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client. not_affected \u2014 Spring Security 6.5.11-tuxcare.4 is NOT AFFECTED by CVE-2025-22223. The vulnerability (method security annotations not being located on parameterized types/methods) was fixed by upstream Spring Security in commit dc2e1af2dab8ef81cd4edd25b56a2babeaab8cf9 (authored by Josh Cummings on 2025-01-08). This fix was already included in the upstream Spring Security 6.5.11 release that TuxCare onboarded ...", "justification": "code_not_present" } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:76fab11f-410e-5218-bf1b-d987668878be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:67c7a02d-2d5a-5040-b1c6-c325e4bc624f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client. not_affected \u2014 CVE-2025-22234 is not present in spring-security 6.5.11-tuxcare.4. The vulnerability (timing attack side channel in DaoAuthenticationProvider due to CVE-2025-22228's 72-byte password limit) was fixed by upstream Spring Security maintainer Joe Grandja in commit c1aa99fdd21 (April 17, 2025), which was already included in the upstream 6.5.11 release that TuxCare onboarded. The fix adds a `for_chec...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:8f463dc7-994c-5e87-a8af-848c6f49fe90", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client. Spring Security 6.5.11 already contains the fix for CVE-2025-41232: UniqueSecurityAnnotationScanner compares methods with equals(), so annotations on private methods are found (fixed upstream in 6.4.6).", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:00ddfba7-f318-5459-9c5d-a8a199aeb8f7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client. Spring Security 6.5.11 already contains the fix for CVE-2025-41248: UniqueSecurityAnnotationScanner resolves generic parameter types with toClass(), so annotations on methods in generic superclasses and interfaces are found (fixed upstream in 6.4.10 and 6.5.4).", "justification": "code_not_present" } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:31d0b3d0-3e02-566f-9884-155321c3c88c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22732 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:5de609b4-01db-5eea-b9de-a33511803f6d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22746 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client. already_fixed \u2014 The target Spring Security 6.5.11 already contains the fix for CVE-2026-22746. The timing attack defense was implemented via commit a317a3d8663995daa2bc91593bb88ae2da21ea52 (April 15, 2026), which ensures constant-time authentication by always executing password verification even when account state checks fail.", "justification": "code_not_present" } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:5e8897e7-ab02-5427-9866-6c4d8a5bead1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22747 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client. already_fixed \u2014 The target Spring Security 6.5.11 already contains the fix for CVE-2026-22747. The SubjectX500PrincipalExtractor class uses secure RDN-based DN parsing (via javax.naming.ldap.LdapName and Rdn) instead of vulnerable regex-based parsing. This is the default extractor used by X509AuthenticationFilter. While a deprecated class (SubjectDnX509PrincipalExtractor) with the vulnerable regex pattern stil...", "justification": "code_not_present" } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:7fa7ac4e-b97c-57af-9a26-b43d44a05682", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client. not_affected \u2014 The target repository (Spring Security 6.5.11-tuxcare.4) is not affected by CVE-2026-22751. The TOCTOU race condition vulnerability in JdbcOneTimeTokenService was already fixed in the upstream Spring Security 6.5.11 release that TuxCare onboarded. The vulnerable code pattern (SELECT without verifying DELETE succeeded) is not present in the target. The fix verifies that the DELETE operation remo...", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:9fe53de1-b1af-5584-b2a1-a223fd807279", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client. not_affected \u2014 Version 6.5.11 is not affected by CVE-2026-22754. The vulnerability is specific to Spring Security 7.0.0-7.0.4 where PathPatternRequestMatcher became the default for XML configuration. Version 6.5.11 uses MvcRequestMatcher for servlet-path handling, which has a fundamentally different architecture and does not exhibit the vulnerable pattern.", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:6e74cbe4-3bab-5ea1-af11-db0620addb8b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41706 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client. not_affected \u2014 Spring Security 6.5.11 contains the complete fix for CVE-2026-41706 (open redirect via CookieRequestCache). The fix was authored by the upstream Spring Security team (Josh Cummings, commit a14c9d66b1) and included in the official 6.5.11 release before TuxCare onboarded this version. Both CookieRequestCache.java and CookieServerRequestCache.java now store only relative paths in cookies, validate...", "justification": "code_not_present" } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:bcc03a63-a6da-5c69-b2eb-fdd6e1c85e12", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47838 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client. not_affected \u2014 CVE-2026-47838 is NOT present in Spring Security 6.5.11-tuxcare.4. The vulnerability fix was already included in the upstream Spring Security 6.5.11 release that TuxCare onboarded. The target uses SubjectX500PrincipalExtractor (with proper LdapName/Rdn parsing) as the default for X.509 authentication, not the vulnerable regex-based SubjectDnX509PrincipalExtractor. The upstream fix commit e3ad55...", "justification": "code_not_present" } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:f181d246-bafe-54b8-ab47-2d2b9665af3a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47841 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client, and is fixed in 6.5.11-tuxcare.3." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:77d68075-5423-53a2-abc9-449346a3759f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47842 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client, and is fixed in 6.5.11-tuxcare.3." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:2c2463ec-e394-58ee-96c7-0a5e9d928194", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client, and is fixed in 6.5.11-tuxcare.3." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ], "bom-ref": "urn:uuid:d783c67e-bc37-5fca-8405-c75519efa615", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.5.11-tuxcare.2 of org.springframework.security:spring-security-oauth2-client. not_affected \u2014 Spring Security 6.5.11-tuxcare.4 is not affected by CVE-2026-59277. The vulnerable InetAddressMatchers class with matchInternal()/matchExternal() builders was introduced in Spring Security 7.1, but the target version is 6.5.11. The entire affected class does not exist in this version, so the vulnerability pattern cannot be present. This is a Type A1 case where the vulnerable code was not yet in...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.5.11-tuxcare.2" } ] }