{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d68c4375-d4e5-5138-90d8-36e7957d3417", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-oauth2-jose", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3", "version": "5.7.7-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-security-oauth2-jose", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7", "type": "library", "group": "org.springframework.security", "version": "5.7.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:e8f9af34-5e51-5417-ac23-bf668a16775b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:d4e22bcc-4f0b-5352-815d-a40ab2f58d45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:0a67b33c-a19f-5060-a9fc-368a8866198d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:8d8a86c7-4155-5a39-9cfd-c3085dfc80d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:0d5d1d14-bd60-533d-868a-8a0c7ad615bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:b538c241-4c13-53e5-97a9-303438eedcf7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:5bccdd94-c4ec-5750-8697-ddaa6cb1c05e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:dce05922-4f71-55f8-8aa4-b58bb084ee06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:199cc995-c546-5be3-b7c9-354b0f36d0e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:9c6ab715-ea96-586f-9f18-f35eb6273441", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:19b23993-6464-5b0e-9b3b-928db37c9b4e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:0ae181cc-dedd-53b1-a9c1-05baa1f76caf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:92cbf21d-03dd-5c81-9c58-3b48105370f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:d945c1a9-ec6a-5e02-915a-ca28d709b564", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:d658fd21-0da8-532b-af8e-d681e696b4a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:9f4ef043-8d68-5959-95aa-5d8edda7f7d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:8a038909-f9c2-56a3-8a06-0ad3fac11470", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:ac19ed78-efcf-53a1-b2e9-b9e2a3667556", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:8bc5dcf3-faa8-5ad1-9d10-3a0b2a2aed04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:5501d54f-7fe0-58a4-91a9-71e5f17956d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:00166e1b-8f17-548a-b731-5f480b45fe52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:a371a6f2-41ea-59b7-ac07-ae67d7c5269a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:47c28e36-fff2-5e1b-b9e3-d98e635d0067", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:d164c514-41cd-5b2f-bd68-f58a47b6f07b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:26b90395-4517-55bd-8af0-c2b884fd5504", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:adeadacd-4fc9-5d85-908a-8a9685a2e5da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:a1d6eeb0-a881-52f1-a82d-cacae2126b62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:89593b4c-05bd-552c-83c0-c0e40859ac98", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2025-22234. This CVE is a secondary vulnerability introduced by the fix for CVE-2025-22228, which added a password length check to BCrypt that broke timing attack mitigation. The target version (5.7.7) never received the CVE-2025-22228 fix, and therefore does not contain the problematic code that causes CVE-2025-22234. The timing attack mitigation in...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:64502fd9-b959-5f64-b717-3dd11516cd60", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.7.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:f7bbe4ef-6243-5786-aacc-6dfd68c329ad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose. Spring Security 5.7.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:a2af642f-9be6-516d-8f5b-cc9957741f31", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-22748", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:0c6e264f-6aaf-5078-946e-8c384b54b50d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22748 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 5.7.7 is NOT AFFECTED by CVE-2026-22748. The vulnerability concerns the misleading behavior of the `withIssuerLocation()` method, which does not exist in version 5.7.7. This method was added to Spring Security in April 2023 (commit 76eba9bd0c), after the 5.7.7 release. The CVE-2026-22748 fix adds automatic issuer validation to `withIssuerLocation()` in later versions (6.x), but ...", "justification": "code_not_present" } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:26383320-7b33-5f01-b0a7-1801dedb3c2c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-22751 because the vulnerable component (JdbcOneTimeTokenService) does not exist in this version. The One-Time Token (OTT) authentication feature was introduced in Spring Security 6.4.0, and version 5.7.7 predates this feature entirely. Comprehensive searches across the codebase found no JdbcOneTimeTokenService class, no OneTimeToken-related code...", "justification": "code_not_present" } }, { "id": "CVE-2026-41707", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:3a9418a9-269a-59c5-96fe-284f41af37db", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41707 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 5.7.7 contains no DPoP code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:50a850ea-1c86-5710-b985-c06725f7d357", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:eda51978-3cbd-5d38-a9bf-3779d3324c5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:4aea1f43-4cbc-5de0-8c7d-1c36d2663575", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-59277. The vulnerable component, the InetAddressMatchers utility class with matchInternal()/matchExternal() builders for classifying IP addresses as internal or external networks, does not exist in this version. The CVE describes a misclassification vulnerability where 0.0.0.0 and :: are incorrectly treated as external addresses. However, versio...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.7-tuxcare.3" } ] }