{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d5f870d7-6583-54ad-8376-36c9f8d2a2d7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-oauth2-jose", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1", "version": "6.0.7-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-oauth2-jose", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7", "type": "library", "group": "org.springframework.security", "version": "6.0.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:f6330b44-8772-5b67-8480-4ab6572b5d78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:024ab7af-65a4-5a1d-aa7f-d2fd3c26dec7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:a7923dba-caf8-5bff-9bee-deedbaa2008b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:c90add38-2d5f-59e1-b340-ff0a92b08bab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:216c6b24-d30e-571c-8f45-b2f201565725", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:27564c78-9440-507e-bb4a-34e70ada4735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:ef8b8616-8abc-5d9d-9756-4e34fd481218", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:1f5a8465-9fdc-506e-938e-9d94adb8eb0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:48e2ae53-9931-54b5-9128-95451856c95a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:e94b530e-e568-5007-83c8-2be4b6b2f031", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:98bd219d-7a44-52a5-a143-f5419713538a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:982b40fa-0daa-5abc-816d-5122165f54ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:ac5b9113-c9c0-57e0-bd09-4d20819dff2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:5afcf088-a969-5f66-91d7-390ddfd98b6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:15617305-4e74-5a44-9722-7c0809682d14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:8edc64d6-8b32-5bf7-9d3c-3ce4c3316307", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:45598735-2e89-576d-94a8-aed7eb44076f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:28c0f04a-38cf-586a-88a4-ebf9d1f4a41e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:fa584bae-208e-5f6d-82c0-6dadd13dd81c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:1dabdd8f-cc39-5590-a7f0-4293783f772e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:c10ec00f-9f8b-597a-93e9-9ab715e4b982", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:c953dd83-4208-5b1b-a4fb-5f3437843b5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:6f3753ef-c68b-5595-8958-dec8047c8fbd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:50eb33c1-0984-599b-9c4f-b162fa699c92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:fbd7d482-33fa-50ca-bafd-3114f6203489", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:ef46a2e5-bb3c-5b62-8765-944fcd2275e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:6a356066-2f91-5cf3-84f2-667e439e75a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:e2cb93b5-4c01-59f6-ae49-4ac545ec87db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:583c95a2-0415-5010-81be-65bd8a53f33e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 6.0.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:ee7b9472-da4a-50d5-a383-121eac5f6fb6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose. Spring Security 6.0.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:a2f7ce70-4997-5a9b-846d-ae071082211a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-22748", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:5796383e-e9e3-5e9b-b582-1bac9e79a720", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22748 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 6.0.7 is not affected by CVE-2026-22748. The vulnerable method `NimbusJwtDecoder.withIssuerLocation()` does not exist in this version - it was introduced later in Spring Security 6.1.0 (commit 76eba9bd0c). The target only contains the safe factory method `JwtDecoders.fromIssuerLocation()` which properly includes issuer validation.", "justification": "code_not_present" } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:830fff45-5d94-5b0b-94d4-556d5cdc4310", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 CVE-2026-22751 does not affect Spring Security 6.0.7. The vulnerable component (JdbcOneTimeTokenService) and the entire One-Time Token (OTT) authentication feature were introduced in Spring Security 6.4.0-RC1, which postdates version 6.0.7 by several minor versions. The target codebase contains no OTT-related code, classes, or interfaces. This is a Rule 5 Type A1 case: the INPUT type (one-time ...", "justification": "code_not_present" } }, { "id": "CVE-2026-41707", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:a491ca28-683f-5d18-b308-d889b9cb5b9c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41707 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 6.0.7 contains no DPoP code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:ac9766e9-d83e-5d4e-b9b4-de45179145bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:9a02131a-065c-5815-b5cb-94eb14b91900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:59fc75d9-533a-52de-8c45-c86751b0f378", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 6.0.7 is NOT AFFECTED by CVE-2026-59277. The vulnerable component `InetAddressMatchers` and its `matchInternal()`/`matchExternal()` methods do not exist in this version. The class was introduced in Spring Security 7.1 (confirmed via upstream @since annotation), several major versions after 6.0.7. While version 6.0.7 processes IP addresses via `IpAddressMatcher`, this class only ...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.1" } ] }