{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:588718cf-018e-5c07-918f-b7719c645021", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-oauth2-jose", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2", "version": "5.7.7-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-oauth2-jose", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7", "type": "library", "group": "org.springframework.security", "version": "5.7.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:cfa71b14-a00d-58f4-be6d-6a1e4026aea6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:ba64fa6e-f72e-531b-a4dc-95e1bb239027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:09106592-4484-5631-8aca-1610b02fe280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:5e873e31-cc36-5081-8d28-01e42d4968f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:fb4bedf4-c9d4-5ad6-8e9d-2055849594c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:91bd5d84-2f55-5efe-9d77-a601e8b9aba0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:ce0ccf3b-e54a-5296-bd6c-f2aca13c88d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:c00ca517-e9ca-51e3-a796-5ad66c1481bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:1b974cc4-b5dc-5c3b-a5e3-61d21866251c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:5ad2d4a2-d59b-5987-b5ed-f3355317cce0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:6e354421-4238-5835-a92a-d96f52576b49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:972fb1f0-dbca-576c-819b-3bbfaef23368", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:0640e5db-d1a5-5579-8e35-8d164ea4f3d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:8e28bca2-75a6-5f5c-9775-84e21f793bf3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:f8021847-9f78-5294-b185-035b3beb46cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:21151bfb-ca22-579b-ba1e-3abfd34c8189", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:53ff275e-5680-5980-88dd-304cb8902004", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:177878b5-42ae-58fb-a4fd-a74532605164", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:a9e1b6ac-84ef-5884-b8a6-02aa05afec5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:62bb5caf-db13-505a-a4a3-99bee33b53ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:e932b3b9-39e3-5bbd-ab3b-879472d3ff2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:f90a9258-cd92-58cc-a72f-49bff3481745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:af13f161-f490-5a1f-88bb-43d7c9f77e5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:8cf5ee84-5b5f-55bf-b138-2c9d40cf5304", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:814e3e07-e669-54f0-8467-12bfadb2b544", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:2051f785-63f6-58e4-a0b8-d0464c0661bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:8db57190-6013-5be9-8b3a-ffd412271239", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:aa440e0a-c3f4-50da-95c8-c98a0833bebc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2025-22234. This CVE is a secondary vulnerability introduced by the fix for CVE-2025-22228, which added a password length check to BCrypt that broke timing attack mitigation. The target version (5.7.7) never received the CVE-2025-22228 fix, and therefore does not contain the problematic code that causes CVE-2025-22234. The timing attack mitigation in...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:00d90249-dc69-51a5-8f29-6052c861fac2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.7.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:53c5c866-8dd0-513b-ad2c-afb0299fd971", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. Spring Security 5.7.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:293a661c-ef8a-53a4-a275-39886811fe32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-22748", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:e6e33908-e6ad-592a-9f35-1bf1de0a60f0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22748 does not affect version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 5.7.7 is NOT AFFECTED by CVE-2026-22748. The vulnerability concerns the misleading behavior of the `withIssuerLocation()` method, which does not exist in version 5.7.7. This method was added to Spring Security in April 2023 (commit 76eba9bd0c), after the 5.7.7 release. The CVE-2026-22748 fix adds automatic issuer validation to `withIssuerLocation()` in later versions (6.x), but ...", "justification": "code_not_present" } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:a2074f85-da93-5af5-8e2e-dd0e84f9c725", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-22751 because the vulnerable component (JdbcOneTimeTokenService) does not exist in this version. The One-Time Token (OTT) authentication feature was introduced in Spring Security 6.4.0, and version 5.7.7 predates this feature entirely. Comprehensive searches across the codebase found no JdbcOneTimeTokenService class, no OneTimeToken-related code...", "justification": "code_not_present" } }, { "id": "CVE-2026-41707", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:261aec56-4f68-5fde-9b02-d557d898a495", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41707 does not affect version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 5.7.7 contains no DPoP code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:d1125872-bb78-546c-9b8c-0df427f7f454", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:abc48b45-4011-533d-8caf-33f44ba9a9dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:8004f340-cb2b-59f1-9795-3c1fc739dee8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-59277. The vulnerable component, the InetAddressMatchers utility class with matchInternal()/matchExternal() builders for classifying IP addresses as internal or external networks, does not exist in this version. The CVE describes a misclassification vulnerability where 0.0.0.0 and :: are incorrectly treated as external addresses. However, versio...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.2" } ] }