{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2d5b4918-fe58-5e17-8029-9c499194b591", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-oauth2-resource-server", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4", "version": "6.0.8-tuxcare.4", "pedigree": { "ancestors": [ { "name": "spring-security-oauth2-resource-server", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8", "type": "library", "group": "org.springframework.security", "version": "6.0.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:00f15db8-9a24-5462-8a9e-fa416c00decf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:ab2e7292-0572-56cc-8adc-b4b00cc6c12e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:f2b1c5c9-7d49-530c-a762-e6ca61769fbd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:f2737b10-ef87-5256-a373-bd7d2b97fcd3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:0043372f-8708-5cea-9eb2-7bc744603e56", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:96ac75d3-37f3-5011-b863-e57fc1786092", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:b4e74cd4-ca63-5399-97be-7cd4a7ffc5d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:dc1f3dbb-a128-56a1-8e55-a665195175fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:8db9d700-c1a5-512f-90ce-12a80181bf47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:87650f2f-b8ae-5aa1-997a-cc66313be13b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:87f2b8e0-0382-5d2d-a358-51890bba8c8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:df6ea586-8864-501c-bc5f-b6d325236d62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:6cf49546-2572-5d53-98c3-1110e5c9a2bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:ae850c33-012d-59e9-b7dc-cae86d80020c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:4e3bad28-b579-559f-9094-4334231acb28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:76d82202-7445-58d8-9192-8788d0145b50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:ef10fa2d-d927-5b0f-9bcc-e03fc72ffe5a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:e11f9eb0-5725-542a-821b-b4c283dcb650", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:3ad6cc0d-2d49-57ee-b99c-65f8093620e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:0c4bb4a8-3d3f-5ef3-84ac-94c441b2f91b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:b949d03d-0e36-5ece-bcb1-9da198784984", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:4d11b11e-ced6-5325-b704-fc6607257116", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:429bd90b-b05b-52c4-9d61-c2d26fec8731", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:9e91bdda-97d1-5c05-a943-45624b3ecdcd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:82e2dc3b-4f6d-53ee-985a-44af4f4ec136", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:cf9ae7a4-c957-5d10-b727-df1bf564dcf2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:b0644c11-60fb-5db3-9bbb-f4eed2146f9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:043a54ec-a038-5683-a77b-91bd4184a081", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:4595a549-5f92-5ec0-babb-f5d3919acec5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:a67c0e0d-ce70-52f3-a5ce-e9cb31d093f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:d1d8c73c-579d-58d3-be67-0570a7d60256", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server. Spring Security 6.0.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:351d7e5d-36c5-5080-8934-a93fb7fab684", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:f8d67f31-609a-55d6-b1e3-cbf1fa0bea2d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:7d3c8494-ff4c-5ff6-998a-8690e338c1a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:ab15dbb1-e975-54b2-ad9b-a10bfbdcfb38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:0750b90f-e0df-5f17-b631-a5c1e576b833", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server. not_affected \u2014 Spring Security version 6.0.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire one-time token authentication feature) does not exist in this version. The one-time token login feature was introduced in Spring Security 6.4.0-RC1, released after version 6.0.8. Exhaustive searches across the codebase confirmed no OneTimeToken classes, JdbcOneTimeTo...", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:666cf215-d75d-57a3-a3d0-cc83704d4db6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcher (introduced in Spring Security 7.0) where basePath configuration is not properly applied. Version 6.0.8 uses MvcRequestMatcher for servlet-path support, which correctly implements the servletPath check and does not have the builder reassignment bug. The vulnerable code patterns from bo...", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:e31ad33d-b042-5e90-b2e0-6bf5ff1d5734", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:d1479810-b178-5dad-a648-4dd194b5c163", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:6c4bfcfb-607c-56fb-8c5f-fb0e6293bc84", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 6.0.8 contains no WebAuthn code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:a5a9bd2f-4f49-5a47-af59-24a69dc79f4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:d35db530-ea0d-57e2-9f21-c1afe845cdaa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:df6100c9-8543-5145-86da-f01b8dd9b609", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-oauth2-resource-server. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-59277. The vulnerability exists in the `InetAddressMatchers` utility class with its `matchInternal()` and `matchExternal()` methods, which do not exist in version 6.0.8. This class was introduced in a later version of Spring Security (after 6.5.11). Without this utility, there is no mechanism to classify IP addresses as internal/external, and th...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.4" } ] }