{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:91f76de9-3764-5309-93e6-bd133eb34d35", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-oauth2-jose", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2", "version": "5.1.6.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-oauth2-jose", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE", "type": "library", "group": "org.springframework.security", "version": "5.1.6.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:db219db6-6c9c-576a-9903-d680683d3edc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:52a45c84-b521-5816-8319-c857eb72b874", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1862bc1d-950a-5bc6-ad7e-63ce22cb032d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:000f22ea-6152-5079-b4ad-ee2b4c6c3d75", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:06831c2b-acf0-5810-9513-d1757ca0677b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1518c05b-54c0-57e9-b707-4eb51afba4c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:73540624-8366-5702-8912-27575fc68149", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:db2a67db-52ab-56d8-9999-55ba51c6b40a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5b4df98d-a9a2-59bf-98fc-ba6c4e475cd1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c2efb689-5299-532d-8cce-1e4d34bc35ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ede482ae-de98-56fd-bf54-fb5bf193fe76", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:647f0752-d9f0-5e98-a9f5-072ea75e04f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e417e527-725f-5ba9-8334-f9e5b8d1e0f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8c5c5c30-6ade-514c-8d60-224e18a50ea2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:799307bf-402d-5307-bcdd-df17b3c3084f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:54d8d250-fb67-5aab-8d20-29646cc898f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1876c5fc-5203-5cb9-98ce-e6e53bf73c0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e2314f65-400f-5ed5-b4f7-874167412669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:115f6c98-3ab6-52d8-84cd-f9f9604074f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:202fba3e-bf72-5e9c-91e1-155167533155", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6b313ad7-c532-5566-8fd5-41764fd565ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:426b77e5-27c0-5e8d-adc7-08518dbb40bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e67bd77b-16f3-590f-861e-fd1d53e7eae3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ce9ee0e8-387b-51b5-a407-96e58564f482", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3999b405-69a7-5b4e-a9ae-f07602cdd935", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3b7b15ca-ed9d-58d6-84f7-ac8f97bd317f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 5.1.6.RELEASE does not contain the vulnerable code. CVE-2025-22223 specifically affects applications using @EnableMethodSecurity (introduced in Spring Security 5.6+), which resolves method security annotations via UniqueSecurityAnnotationScanner. Version 5.1.6 uses the older @EnableGlobalMethodSecurity API with PrePostAnnotationSecurityMetadataSource, a completely different impl...", "justification": "code_not_present" } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f2a37e1b-0f9e-58bb-b5af-547d803d5f63", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 The target spring-security 5.1.6.RELEASE is NOT affected by CVE-2025-22234. This CVE addresses a timing attack vulnerability that was inadvertently introduced by the CVE-2025-22228 fix. However, 5.1.6.RELEASE never received the CVE-2025-22228 backport, so the vulnerable code pattern (unconditional 72-byte password length check in BCrypt.hashpw that breaks DaoAuthenticationProvider's timing atta...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7930776e-86c9-5177-af94-09be084a91d9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.1.6.RELEASE does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:89c35183-7e49-5f14-92f3-a65d7baf23ee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.1.6.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:25f7e9a7-e5ce-56cf-8508-c4419d5f1704", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-22748", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:12516910-6e70-50f8-96b5-f44ea4f54c6e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22748 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 5.1.6.RELEASE is not affected by CVE-2026-22748. The vulnerability concerns the `withIssuerLocation` method in NimbusJwtDecoder and NimbusReactiveJwtDecoder, which creates confusion because it accepts an issuer parameter but does not automatically add issuer validation. This method does not exist in version 5.1.6.RELEASE - it was introduced in later versions (5.7+) in April 2023...", "justification": "code_not_present" } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:085dd112-abd3-5359-9c08-a99bed946aa9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire One-Time Token authentication feature) was introduced in Spring Security 6.4.0-M4 (July 2024), long after the 5.1.6 release. The target version does not contain the vulnerable code, cannot process one-time token authentication requests, and lacks the authen...", "justification": "code_not_present" } }, { "id": "CVE-2026-41707", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:53f4178d-78d2-57c0-b5a0-3886dfde8132", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41707 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 5.1.6.RELEASE contains no DPoP code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:048d715a-772e-5216-9947-e16993e316b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7b563d46-6d35-542b-a4be-01699f852b9c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.1.6.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 5.1.6.RELEASE-tuxcare.2 is not affected by CVE-2026-59277. The vulnerable component InetAddressMatchers (with matchInternal() and matchExternal() methods) does not exist in this version. The class was introduced in later versions of Spring Security. Version 5.1.6 only contains IpAddressMatcher, a CIDR-based subnet matcher without internal/external IP classification capabilities,...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.2" } ] }