{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:01bda6f3-951e-5c73-9473-b165d09eb498", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-oauth2-jose", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2", "version": "6.0.7-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-oauth2-jose", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7", "type": "library", "group": "org.springframework.security", "version": "6.0.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:4f5c4286-85bf-5827-b160-92889da6c2a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:fbfc3908-06ad-5ad4-809a-7c4c2eae6b45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:839462db-41b4-534c-b7ed-4122008eaf25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:65a76f39-b8df-57f8-a4ea-fe7e6a55ef4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:3cd91f5a-acc2-5484-8543-3172142242e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:8cb7d79a-de79-5895-a8c1-6e1a73b58f92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:571a8995-b05b-5f53-89d0-d7ce958e7130", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:6200e349-87da-5994-a882-28bd50f0ebae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:34d9677f-a1b5-58bc-b7ab-7c9452736349", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:16626d8c-8eda-5c05-b6ea-85a59b5cb9b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:c525183d-457b-517c-af5f-eff6f2ba8fac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:7adca455-2cef-5345-913b-ac3e85ba2a6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:c2cfd3f4-55fc-5470-8ba2-1096b3026418", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:c46b41fe-07ed-5d1a-ad3b-1fc5efd73fe8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:e6d6cdb8-65a8-5542-9c29-bdede8f28158", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:93656e65-9b22-5042-8f1a-2d09910cfb87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:3cdca114-1663-51b1-8ce4-d908d1fbfba0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:b9d42b6d-2985-5562-af80-9459e8e27158", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:d32f2152-a807-5c47-b3f8-a22ad4373e07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:df5eae2b-493a-5a65-8694-a4305618ddee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:b787fe30-c7ba-5499-8710-6ec66d160c91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:0b0e4199-01d5-53fa-83c3-10dbcdf9635d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:6f7a202a-cb1e-5c57-b451-c3cb55e18f20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:dbfad1f6-c7f4-5e43-936b-47f835b26370", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:c917cd93-634a-5f25-ae64-4686ca9b94ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:07fe1df7-804b-53aa-881f-525ef3496a03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:85f3068f-77f6-5add-8541-e47ab7b2b6f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:57470348-ccf1-5187-983a-e8482a6759ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:7a4a86c2-7caf-5695-887a-f65075f0d5ea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 6.0.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:9538df99-c7ff-531e-81ba-4b1916de0540", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. Spring Security 6.0.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:5dd0d5ad-db23-57a2-ba2a-4579e676fbd1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-22748", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:68f58adc-c052-52a5-bd48-a57c015a2578", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22748 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 6.0.7 is not affected by CVE-2026-22748. The vulnerable method `NimbusJwtDecoder.withIssuerLocation()` does not exist in this version - it was introduced later in Spring Security 6.1.0 (commit 76eba9bd0c). The target only contains the safe factory method `JwtDecoders.fromIssuerLocation()` which properly includes issuer validation.", "justification": "code_not_present" } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:94308d90-a428-5387-bbfa-c685a2ae311c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 CVE-2026-22751 does not affect Spring Security 6.0.7. The vulnerable component (JdbcOneTimeTokenService) and the entire One-Time Token (OTT) authentication feature were introduced in Spring Security 6.4.0-RC1, which postdates version 6.0.7 by several minor versions. The target codebase contains no OTT-related code, classes, or interfaces. This is a Rule 5 Type A1 case: the INPUT type (one-time ...", "justification": "code_not_present" } }, { "id": "CVE-2026-41707", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:e98816dc-37f1-55ed-a190-965ccef30e04", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41707 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 6.0.7 contains no DPoP code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:347e6994-55ee-5c92-8571-c21907310ab7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:785b951e-8210-5ee4-8795-66166f9d2f6c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:9d42ac12-7a78-504a-ba4d-9e44e03038dd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 6.0.7 is NOT AFFECTED by CVE-2026-59277. The vulnerable component `InetAddressMatchers` and its `matchInternal()`/`matchExternal()` methods do not exist in this version. The class was introduced in Spring Security 7.1 (confirmed via upstream @since annotation), several major versions after 6.0.7. While version 6.0.7 processes IP addresses via `IpAddressMatcher`, this class only ...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.2" } ] }