{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:06751c5e-3e17-5724-884f-e45b0ab43cd6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-oauth2-jose", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5", "version": "6.0.8-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-security-oauth2-jose", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8", "type": "library", "group": "org.springframework.security", "version": "6.0.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:eb08455f-b39a-5724-8ce1-db9157bd6dca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:8c00b83e-bfe1-5ba5-9380-354329fdd3b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:9cb39ff8-06b5-5a73-a36e-f5b924b5bb25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:3df02af2-0065-5ec5-ab47-8531a06343d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:5b00188b-c1e1-550e-8126-8f4ec89db107", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:12520cf9-7207-57e0-ab38-c287c2b35fda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:abea61be-78ae-50c1-990d-15c2ee3c8d5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:2c79509c-eda1-5795-badd-29b4269971ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ff94f24c-083b-5f7a-9171-c7ae6aacaed2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:430c533d-5414-5e27-8eab-da8f92134182", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ee8358ec-1f73-5805-a76c-78327717115c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:2b551690-c39c-53f6-8f1e-15ede53a3c65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:302a964d-913e-52eb-a9c4-479e49438ed6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:b691528f-b759-51d4-a561-ae16c9d47135", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:69f4e528-fc3d-5488-a860-680f0fa0bac8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:49a589f2-93f1-5b9b-b7df-3c85895b0f9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ae866cfa-1d69-528f-ac0a-61c599f85b7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:11ae8b15-f2eb-5a7d-ae78-6b53407243e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:fc2bdd7d-bc50-5e1d-96bd-6d0bb829cdf7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:d8e178c2-0932-590b-a693-99c6a174bf61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:cbde4c7d-2fb0-5152-bdc7-ea3eb3734c54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:f3d51859-ef0c-5fac-91de-1231b6cf84f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:4dadd4ac-b4c0-51e6-aac4-929aacd1f5ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:a4f86d15-820f-5455-82dd-57f293da36e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:00158e3c-d89d-5402-b5fc-7f299872c112", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:943b73d8-53b8-58dc-b595-9d0c4300d563", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:d8726be5-da18-58b4-ab4d-f8f4f9ffb71c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:a43c96b3-04bb-5395-9903-d4dfa3ed9958", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:5cbb0dd8-bf9c-5dea-bf87-effdffeadd22", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose. Spring Security 6.0.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:e9daf2b3-742a-5a70-8cba-3e1ff8920a5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:be8c6c00-602f-5e13-8736-dd3f361a2e97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-22748", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:17c765e0-95c6-5524-9d8d-1a8643887e1f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22748 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security version 6.0.8 is not affected by CVE-2026-22748. The vulnerability concerns the NimbusJwtDecoder.withIssuerLocation() and NimbusReactiveJwtDecoder.withIssuerLocation() builder methods failing to automatically validate JWT issuer claims. These methods do not exist in version 6.0.8 - they were introduced in version 6.1.0, approximately 225 commits after the 6.0.8 release.", "justification": "code_not_present" } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:b5583664-cea2-5963-84d4-73fd3a711590", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security version 6.0.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire one-time token authentication feature) does not exist in this version. The one-time token login feature was introduced in Spring Security 6.4.0-RC1, released after version 6.0.8. Exhaustive searches across the codebase confirmed no OneTimeToken classes, JdbcOneTimeTo...", "justification": "code_not_present" } }, { "id": "CVE-2026-41707", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:bd428ab3-cdbd-5d26-8c36-992906d07a23", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41707 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 6.0.8 contains no DPoP code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:774ef46d-1f22-5d25-bcfd-5acc1a39f9c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:2994854e-53c6-54fa-936c-2887a59a6007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:03b12570-eb58-5c58-9ccb-879bb6a6fe4e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-59277. The vulnerability exists in the `InetAddressMatchers` utility class with its `matchInternal()` and `matchExternal()` methods, which do not exist in version 6.0.8. This class was introduced in a later version of Spring Security (after 6.5.11). Without this utility, there is no mechanism to classify IP addresses as internal/external, and th...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.5" } ] }