{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9ff1c684-5cfe-589b-8986-195bab142260", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-oauth2-jose", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21", "version": "6.3.10-tuxcare.21", "pedigree": { "ancestors": [ { "name": "spring-security-oauth2-jose", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10", "type": "library", "group": "org.springframework.security", "version": "6.3.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:8839b7b7-3a51-58cb-8703-0df10a0ccd35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:22fc6401-f88d-507e-b3f6-cf5566d49d6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:3b766720-a8b1-5fc5-911b-5fc862aec145", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:663bc39e-bcd6-5e12-a487-ad3d378969f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:e0c4b32b-c082-5ab2-bbd4-0885a2594cea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:52eea3eb-ff0b-54d6-8b0f-2ef36a9c0636", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:dd83d80a-c47c-5dca-a211-920e0728ac2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:fdbb039c-8618-5b6d-8770-bca201e7409f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:8b72cfdb-ef10-5567-8903-555fb65f415a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:af0b178e-5a0c-5fc7-8947-b49b313957d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:c1d2662f-890f-579e-8212-18788bf3fe82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:b2a9b67e-cfc7-578a-8dff-796a914b49fb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1258 does not affect version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 The target Spring Security 6.3.10-tuxcare.7 is not affected by CVE-2018-1258. The vulnerability existed in Spring Framework versions 5.0.5/5.0.6 and was fixed in Spring Framework 5.0.7 (June 2018). The target depends on Spring Framework 6.1.20-tuxcare.5, which is approximately 6 years newer than the fixed version and contains all security fixes from 5.0.7 onwards.", "justification": "requires_dependency" } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:d64a936a-1e9e-56f2-a4d4-c3c1082ea768", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:f8909d56-043c-556a-9622-6e43a0c8ea7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:14025517-d101-5f0b-8344-ca4e82103251", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:b438974f-3d89-51d0-a4d0-f2e9555234d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:452313f7-dd1f-5d38-8c7a-507b1c109726", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:d741b61a-13fc-5886-a2fd-e9e1e6c88535", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:36840c74-d9a3-5f3b-8dd2-57c5c224d68e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:4446dcb0-6e68-57da-86e2-6766e3e9334d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:5da96298-246a-5870-a610-7a3d0bafe385", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:39032293-9fea-52b7-ad5a-13ea629bf7db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:219499ea-7106-5cce-a2b1-4433997e43b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:d9b25d95-5687-5c46-af86-dba1396974c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:aa68df5e-19f4-5d87-85ce-dfe38bdbe61d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:ccb01ddb-a08c-556a-8d87-e8e7113190b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:9a287a49-3061-5cdb-b8af-d5bc2b581618", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:d000ec22-1a1c-56bf-ac2a-f18ab95d47b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:260e6566-60c2-5b2d-81ea-724ee0689b3e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 The target repository (spring-security 6.3.10-tuxcare.21) is NOT AFFECTED by CVE-2025-22234. The vulnerability was fixed by upstream Spring Security in commit c1aa99fdd2113a232986e9c3a44673ae752de840 (dated 2025-04-17) before TuxCare onboarded version 6.3.10. The fix conditionalizes the 72-byte password length check to only apply when encoding new passwords (!for_check), not during authenticati...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:3c950793-6510-59fe-8626-81da1b71833f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41232 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:b0283dcf-e24f-525d-bd91-36682580199b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:79ce9287-fc96-53ed-b201-a222e63207d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-22748", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:61915f3b-2389-5b8b-8d88-5c8070458347", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22748 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:7e518264-8a83-53d3-b0bb-885cae9b1487", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.4.0, which postdates this target version. The one-time token authentication feature does not exist in 6.3.10.", "justification": "code_not_present" } }, { "id": "CVE-2026-41707", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:8d879f86-49ca-5dbe-a44d-c5fb8944232f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41707 affects version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:8ae4c84b-702a-5c4b-a9a1-bfe6efbf9a15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:1bd25171-a00c-55b6-95b4-6a9866a7af8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ], "bom-ref": "urn:uuid:ac0c7177-dffd-579c-995c-4c82388f361a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.3.10-tuxcare.21 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 6.3.10 does not contain the InetAddressMatchers class or its matchInternal()/matchExternal() methods that are affected by CVE-2026-59277. The vulnerability concerns incorrect classification of \"any local\" addresses (0.0.0.0 and ::) as external rather than internal. This functionality was introduced in a later version of Spring Security (patches dated June/July 2026, after the 6....", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.21" } ] }