{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6506608b-81d2-52fe-a0a1-39397e5f35af", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-oauth2-jose", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19", "version": "6.3.10-tuxcare.19", "pedigree": { "ancestors": [ { "name": "spring-security-oauth2-jose", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10", "type": "library", "group": "org.springframework.security", "version": "6.3.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:652a3c4d-5691-51b7-94c3-0246197a201a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:9a4c58fe-5d74-5a37-b81d-ddd285fbe53f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:ce461ffc-3c47-5e78-a0f4-835372f6c970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:46a793b2-087b-50e5-82dc-6cbad8941cbe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:a06dae58-cad6-5d48-9e8a-ae0a6b9443fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:5c6b0206-8538-5e58-a843-f4dfc4122474", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:94ca6b41-9c95-50d9-b5b2-04ede9fe5243", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:aac3263e-9065-5399-ab60-5cb369204b02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:b95734d9-0145-50c4-9251-e57a7b626be3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:7ae7be47-83c3-59fb-afc7-cd731deae36f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:cd543425-254c-580b-9b6d-66cb9c685792", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:9244c856-5d9f-5c4d-9920-ebae31fd62bc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1258 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 The target Spring Security 6.3.10-tuxcare.7 is not affected by CVE-2018-1258. The vulnerability existed in Spring Framework versions 5.0.5/5.0.6 and was fixed in Spring Framework 5.0.7 (June 2018). The target depends on Spring Framework 6.1.20-tuxcare.5, which is approximately 6 years newer than the fixed version and contains all security fixes from 5.0.7 onwards.", "justification": "requires_dependency" } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:2fa40981-227c-5fa8-8ae3-80eb4351905e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:1ac240ff-2506-5fb5-bc5e-1cf353132a90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:24dd309d-9a6f-5014-a84f-b218b7197ade", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:4ea94d7f-6ad8-5fe4-94a1-718465ab4816", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:6c9f45aa-258c-5ce0-a11e-bb573577e9f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:0346c4bf-cdb3-5cff-96a0-c286736d8e2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:51e00ac1-643b-5e8e-bb91-199914c6a23c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:8e442c74-b5e6-56eb-859a-022501bfa5d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:844bdbc2-46ba-5b7e-a0f5-e6f078bee193", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:75419df8-00ba-5583-97a3-6f7ec7e54ecc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:970e1ace-7e28-5504-bcc5-b2cd3036b149", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:c8507271-d833-538b-9c05-32a376defdb4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:c0f8bc74-0ff2-5aa4-accb-d86a089e581d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:42b54153-1fa3-5845-a5ce-29f0941c236b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:0f347c2a-081f-5417-82b0-4275ee5d1ccc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:3870a5be-01b3-55cf-8d06-652c5bcb8714", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:7aa8f37e-de94-5e1d-8940-6ef003505e81", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 The target repository (spring-security 6.3.10-tuxcare.21) is NOT AFFECTED by CVE-2025-22234. The vulnerability was fixed by upstream Spring Security in commit c1aa99fdd2113a232986e9c3a44673ae752de840 (dated 2025-04-17) before TuxCare onboarded version 6.3.10. The fix conditionalizes the 72-byte password length check to only apply when encoding new passwords (!for_check), not during authenticati...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:1e5a9df3-a8d1-5f09-b75d-82c5b0d9d95f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose. Spring Security 6.3.10 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:86519942-ffc0-50f4-94b0-de71b49458fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:f681dfbc-e799-5fc9-8060-c1063c9d4e46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-22748", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:cd83d345-3c78-5f44-8e1f-c566ad6db740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22748 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:3a279448-3645-558d-add4-40681d7814d5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.4.0, which postdates this target version. The one-time token authentication feature does not exist in 6.3.10.", "justification": "code_not_present" } }, { "id": "CVE-2026-41707", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:a2b5c05f-b374-54f2-9804-292fa17317df", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41707 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 6.3.10 contains no DPoP code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:c7c4b3bb-e80c-5217-a772-e16a4b6bf06a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47842 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose, and is fixed in 6.3.10-tuxcare.20." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:626fa1ba-5bad-5f4f-8c5a-c07b9712e3df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose, and is fixed in 6.3.10-tuxcare.20." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ], "bom-ref": "urn:uuid:b8f2241c-0a09-5c22-93bd-d2272cb965e9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.3.10-tuxcare.19 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 6.3.10 does not contain the InetAddressMatchers class or its matchInternal()/matchExternal() methods that are affected by CVE-2026-59277. The vulnerability concerns incorrect classification of \"any local\" addresses (0.0.0.0 and ::) as external rather than internal. This functionality was introduced in a later version of Spring Security (patches dated June/July 2026, after the 6....", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.19" } ] }