{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:37c33b91-152d-5e5f-ab6d-de38c73880b8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-oauth2-resource-server", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2", "version": "6.0.7-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-oauth2-resource-server", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7", "type": "library", "group": "org.springframework.security", "version": "6.0.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:734ae598-9f7c-5e78-8563-2573b143f812", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:65430c94-1e0d-55c7-8312-20e5885e5ca3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:969bebfa-91cc-5408-8cfd-a7f403a21af8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:29f1d1c9-22d4-56f0-9481-cf0fb078979b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:dd5aab18-bead-55ab-b985-b655daefe694", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:ca7439be-860f-5903-8232-1cd899770e0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:62509cf1-8c4c-56bb-84c9-e5e72c7982cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:e2f18327-74ea-5f9f-ac4e-e1421d586999", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:9a43b060-7a86-5f8e-acb0-84840284194d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:0918bc43-8134-5ad2-8718-681687f0c27a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:a07f7bb1-7e45-5d02-a0d8-dcc945943f3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:5c1ced44-ffcb-560a-bb7a-5951dc057323", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:5813379c-231b-5565-b1a2-f180744e2fda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:6c8c4338-6038-53d9-81fe-c8fe460cce55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:fc925e61-9d35-52b6-940f-d073e39451f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:cd816c5d-3728-5ae9-8f40-ff8e7c13cb2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:e63fdfce-3762-578c-9d1c-4e65f633cb81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:acc6d0b2-2c15-5f5a-991e-4efe88cb9499", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:9528454f-441b-53a8-8d7c-c94a1c9d2307", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:5547dbf6-e060-5a87-8dc5-456b2443a101", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:5252acf3-6446-5aff-865c-90d4dcc72ec9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:1f954def-ffe8-5b6a-999a-6e9775030d2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:78cbec19-02d9-5d18-9f9c-aec3a74a653d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:cea413b2-801d-5db2-8ceb-0886d87acfd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:ee20916b-5ebb-5c00-8e4c-fbdeeb5b9ef2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:0a2aeb4d-ff2c-577b-8185-b2a0ae6f7947", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:1594da10-e53e-5c62-b321-28f272d95141", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:7d665b75-a749-5b18-95f0-8b53b4330bc1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:f57c1b8f-c660-5dfa-8aa7-30e0b83dab39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:4dd19656-a0fc-59ad-b5ec-ed9d480c14bd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:92e6bd22-7199-5187-8bfc-fd152d0ddba1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 6.0.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:03338ee5-3f09-5f54-bfe1-8997c9a1d85b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server. Spring Security 6.0.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:afe0a29f-b977-516f-88ba-46359389211b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:a4ab8187-ca18-5ec5-8164-b176e46e813e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:fd4034f7-c606-5f7e-81b9-3d92f91d23bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:e0c5b0a2-0fe3-5fef-959e-4f99b928e2cf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server. not_affected \u2014 CVE-2026-22751 does not affect Spring Security 6.0.7. The vulnerable component (JdbcOneTimeTokenService) and the entire One-Time Token (OTT) authentication feature were introduced in Spring Security 6.4.0-RC1, which postdates version 6.0.7 by several minor versions. The target codebase contains no OTT-related code, classes, or interfaces. This is a Rule 5 Type A1 case: the INPUT type (one-time ...", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:8ee37045-98c4-52b9-833d-6d59ecf6b69b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server. Version 6.0.7 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcherFactoryBean (introduced in Spring Security 7.0.0) where a builder reassignment bug causes servlet-path configurations to be ignored. Version 6.0.7 does not contain PathPatternRequestMatcher or PathPatternRequestMatcherFactoryBean. Instead, it uses MvcRequestMatcher for servlet-path support, which correctly handles the configuration without the builder bug. The CVE's affected version range (7.0.0-7.0.4) is accurate; this vulnerability was introduced with new functionality in 7.0.0 and never existed in 6.0.7.", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:4efcb5e6-2d5a-5509-8202-349e844cd2ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:88d5e4da-3515-5f9e-bc8a-352edfd7b538", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:16d04aa5-4e1e-59b1-a1ba-01893bac28d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47841 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:195be310-88b6-5702-b8d9-5d04cf993f1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:7484df2a-6737-5ddb-86b6-f157f76fbec7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:5a43993e-097a-5819-8fc5-8476bfe7d660", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-resource-server. not_affected \u2014 Spring Security 6.0.7 is NOT AFFECTED by CVE-2026-59277. The vulnerable component `InetAddressMatchers` and its `matchInternal()`/`matchExternal()` methods do not exist in this version. The class was introduced in Spring Security 7.1 (confirmed via upstream @since annotation), several major versions after 6.0.7. While version 6.0.7 processes IP addresses via `IpAddressMatcher`, this class only ...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.7-tuxcare.2" } ] }