{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d9802bc6-a76c-51bd-a6d5-4d4aa3eebff6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-oauth2-jose", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5", "version": "6.2.8-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-security-oauth2-jose", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8", "type": "library", "group": "org.springframework.security", "version": "6.2.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:db82ccf2-613f-5a29-9bcf-53f53471e5cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:a4a91d00-0b6a-5593-9b44-5ad003cb6aef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:7b2af6ea-8e9d-5b34-8579-b93cd57ec468", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:69fdce82-b834-58e3-bdcb-ffbc6704e4c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:01345a31-db03-55fc-bc35-05d6d7e1ea87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:2f0a8ca3-dc86-52b2-9ffb-25cc1eb0946d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:a2fb9f04-b178-5318-a1f2-8496eff49524", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:992b7503-067d-5127-9721-5083b5cde011", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:30b58205-5031-5396-8d18-1b1021d01740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:2b47c86d-e945-5a05-92ab-b8559f3e6615", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:b86d97f7-5668-5863-b5c5-2c09524c51d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:46faf2fe-96a7-5bf5-b53c-c11e0fc0760a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:6bc7df8e-c7d7-57a6-b051-93739fbbc4c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:bb9c3a74-7d31-5d8c-b47d-470a67b6e2f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:9daf5bf6-5a91-54bd-9bed-9318b3bdd9fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ee2a6e9b-90be-5ca6-b7a9-1c43c1a68750", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:84790c23-344e-54c6-822e-0b93782aba25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:8a26558c-1447-5c21-95ec-6202c6b69b97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:2190a9ac-206d-504f-a671-f145268ac219", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:73b7b5a4-909e-51b0-804c-3cb2c32b8270", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:cabe531f-b34c-5fcf-babb-badde839e049", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:12890d9a-5f08-53a3-bc41-537f5e582f88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:90021de2-d3b7-52b6-814d-854777d2e855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:83fbae5b-17db-55be-9dd3-7b0861150517", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:1d8ec8d5-8911-5d7e-826a-e119a4b0b550", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:38f41322-5d2f-5169-a3b4-7c87bc12345e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:42d84522-b7ec-5e49-8d57-7b89a6845ecf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:87ba5b42-9390-51df-8393-443cff463160", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:c5231f9a-2c08-58dc-a3ac-8481bc700373", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose. Spring Security 6.2.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:978003cb-38a3-5830-9646-b67e70efe97c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:3d7cb9df-cb67-52b3-bfd3-7a264f1b3190", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-22748", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:076af1b3-9b5a-5e35-a08a-eb438d2b3c53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22748 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:292f6e7c-b3cb-5d61-8b39-86435d1f4681", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService) and the entire OneTimeToken authentication feature were introduced in Spring Security 6.4.0, which is a later version than the target 6.2.8-tuxcare.6. The feature does not exist in this codebase, therefore the TOCTOU race condition cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2026-41707", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:27e633cb-23af-562d-ae11-9767fa31afd9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41707 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 6.2.8 contains no DPoP code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:34400ea0-5ed2-5390-8d65-119416e0dd58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:b4a6e240-2464-5834-8b0b-8b8962a24904", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:f16c69eb-fcb4-538c-bbf4-37c90d9517a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 6.2.8-tuxcare.6 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class with matchInternal()/matchExternal() builders) does not exist in this version. The CVE affects a utility class that classifies IP addresses as internal vs external for access control purposes, but this functionality is not present in 6.2.8. The existing IpAddressMatcher class s...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.5" } ] }