{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cdd92f97-0d66-5a39-af45-5b051329109c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-oauth2-resource-server", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1", "version": "6.0.7-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-oauth2-resource-server", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7", "type": "library", "group": "org.springframework.security", "version": "6.0.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:17e66225-6803-5c37-9f4e-1bc4b59536e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:13c9f90a-d18a-5cb5-8197-530bbc8825e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:a0d6f27f-ea25-508d-82aa-49b222277956", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:eb85d232-7a26-59df-b336-fec75de68c26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:17c19a26-175c-5f75-85cd-d9b5b485632b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:d561e572-8a54-5430-909b-d18b9c83aed8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:e00d8dfd-1810-5929-a858-b94515415b03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:f0d7e399-302a-5a26-a08e-228e721119c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:ffba65e4-b114-5cd4-bf35-ec2735a47a85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:d06e4d13-3c55-5fb4-b769-a1aab1f91a84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:e45dddb4-bc01-5845-aeae-bf87013bbd55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:0e886826-3210-572f-af7a-60a805849fc9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:38d84259-f530-5e56-af6c-0a176cddbe36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:401f5b60-e06a-52d1-b3c3-155992d79673", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:25b632f3-ae51-5fae-a73a-b331751b3565", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:fa1e566e-e8ae-5ccd-a2fa-97f2a018e7fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:75cc2bcc-de66-52d0-9f45-67385602c15c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:39e79fe3-fa48-59f5-b83e-9b83ce14fe1f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:7c02c088-7213-557c-95dd-31f3895f6b69", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:096ab027-dd0c-5d5b-8b88-091152603721", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:7338e9bb-a0ba-5701-9d15-a27288e6c805", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:aac4a5b8-ddda-5774-a21d-43a34bbe38a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:6a8f0c23-24e3-51a7-8fa2-2b34f202689e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:a885daca-094b-579d-8c65-16d8562813df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:7a8a3fca-1547-53b1-a4da-9a9033d22e3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:f525f1c0-a714-5af9-93e5-ab6704ee7eff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:28dbf506-d7d3-5951-95d2-c9b498bd867f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:83271475-6b2c-5260-a386-a2913b51817c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:469dbc98-17e3-5483-8407-8cca86866f4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:b0d49577-619e-5274-9bc5-cccc062bca3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:d23d17fd-907d-5fac-8810-3210b631f27a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 6.0.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:dd2d5d9a-c3b8-5487-b0cc-82afe40221ad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server. Spring Security 6.0.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:c3059469-5169-53ca-8531-e10cf0096d36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:4e1d0f6e-6983-5029-ad46-93ab16511442", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:80904ae2-1ec0-582a-a19d-3328b88724d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:a8c9f222-3c81-5c05-a0b5-64b95f5ca347", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server. not_affected \u2014 CVE-2026-22751 does not affect Spring Security 6.0.7. The vulnerable component (JdbcOneTimeTokenService) and the entire One-Time Token (OTT) authentication feature were introduced in Spring Security 6.4.0-RC1, which postdates version 6.0.7 by several minor versions. The target codebase contains no OTT-related code, classes, or interfaces. This is a Rule 5 Type A1 case: the INPUT type (one-time ...", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:e2b35455-7f7d-5f99-80c6-3c3c1fc55a9b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server. Version 6.0.7 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcherFactoryBean (introduced in Spring Security 7.0.0) where a builder reassignment bug causes servlet-path configurations to be ignored. Version 6.0.7 does not contain PathPatternRequestMatcher or PathPatternRequestMatcherFactoryBean. Instead, it uses MvcRequestMatcher for servlet-path support, which correctly handles the configuration without the builder bug. The CVE's affected version range (7.0.0-7.0.4) is accurate; this vulnerability was introduced with new functionality in 7.0.0 and never existed in 6.0.7.", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:8f09c401-e616-56a8-a880-4d70293f9a87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:849ec413-0f2e-5fb2-99dc-257ae4a9a413", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:72cf9c76-80bd-5fcd-ba92-d2c7c243247e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47841 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:2b31689b-9478-58c0-9315-f77ee98cbb27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:475e2ca6-596f-5f05-88f5-dd2d4d696b4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:ffeca0a4-f816-512c-bbc8-d205fd6c6149", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server. not_affected \u2014 Spring Security 6.0.7 is NOT AFFECTED by CVE-2026-59277. The vulnerable component `InetAddressMatchers` and its `matchInternal()`/`matchExternal()` methods do not exist in this version. The class was introduced in Spring Security 7.1 (confirmed via upstream @since annotation), several major versions after 6.0.7. While version 6.0.7 processes IP addresses via `IpAddressMatcher`, this class only ...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.1" } ] }