{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3be916a9-df3e-523d-9f6b-5a9dc04d9d73", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-oauth2-resource-server", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5", "version": "6.0.8-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-security-oauth2-resource-server", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8", "type": "library", "group": "org.springframework.security", "version": "6.0.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:03986a87-f073-5842-bfca-8fb0d5091f1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:825c7d63-cf16-5633-891c-14890c67d4cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:05200dff-161e-5264-9134-f450cec76546", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:43cd7f5d-0e80-50bc-a2ab-e5eda7f47332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:bd246b80-8b1b-5efe-8e3d-4a3a49480aad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:51679ae2-86cb-5b06-b7bd-dc9ef472b24f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:69ee69ca-dd7e-5b61-87ce-51477c16ef13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:7d598903-7b16-5623-9e61-586bc558335c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:4e35e212-4bb1-5ec2-b5fa-81e1e5d87c60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:0613c625-17a3-53b5-86fa-9e1859968ec1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:102b850a-c05f-5524-b71a-23daa54704c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:2eb706e2-481b-58b0-a380-905d69558dd2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:17f9893f-a9a8-5f1a-b628-e82ab7471654", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:bf98e1e6-3a32-5442-b3a0-3f677f430fb8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:7c378665-8ae6-5a40-8bf7-2dfdacbddcdc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:9d5bbef5-0a32-5af6-add0-c6c06089b4a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:0e47f05d-7f90-5abd-a3d9-e46059e951b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:d2a2ac58-bf80-5708-9010-ce3fff83b209", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:09e4f956-67d4-54f6-9daf-54909ed0250f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:e5a4f843-866b-5c61-bb01-d2bffb320e94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:d52eef68-26df-5695-b458-89b34ce5422d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:72bc8c0e-4b38-50ee-a262-d1c1eeace35b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:f1ddfcdc-5855-53a2-8c3d-8212bd9ca4b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:04324495-1095-55f4-aec2-b72fd40d0fea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:a94efb22-d800-5e05-829c-fe98c61a8b54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:92c4f00b-c29b-5895-ad86-3b21539fd6e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:aafc75ef-10b2-594e-ac28-f4d26b1282c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ee8cb5ce-5105-5cb7-95a6-6b87ea022825", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:f6aaa0a0-4ef6-51a7-a34e-34bb21ea8c3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:045a2a7e-f0d5-5556-b33a-ca6e0242ca86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:0c39544c-d996-5972-ab5f-9bac7a5d2034", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server. Spring Security 6.0.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:eb026ef6-afe6-5009-9ad2-1030eb70ae4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ff797eb1-d7b5-5e3c-8014-76d810d211cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:1b0acfb7-a90c-5b1d-8fd3-7a55f799e395", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:31454795-6a0e-5ee3-8ceb-beed0edb75ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:2743fa17-0773-5065-8363-ebd0612cd9c5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server. not_affected \u2014 Spring Security version 6.0.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire one-time token authentication feature) does not exist in this version. The one-time token login feature was introduced in Spring Security 6.4.0-RC1, released after version 6.0.8. Exhaustive searches across the codebase confirmed no OneTimeToken classes, JdbcOneTimeTo...", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:15043310-aadb-542a-afa0-2d89b37ae870", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcher (introduced in Spring Security 7.0) where basePath configuration is not properly applied. Version 6.0.8 uses MvcRequestMatcher for servlet-path support, which correctly implements the servletPath check and does not have the builder reassignment bug. The vulnerable code patterns from bo...", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:d7a7433d-8547-5ba5-a48f-a63f3f2f6b4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ae3b4775-9b1c-574b-889c-84550cbdfe72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:bddf96d1-f7c6-53e4-a10b-42130fd933b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47841 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:f68536e6-de5b-5583-900a-6169094f7e52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:96a2ae88-b97a-524b-8291-0ec6b4119b90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:010c4668-752a-5795-9dc1-92985095ec24", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-59277. The vulnerability exists in the `InetAddressMatchers` utility class with its `matchInternal()` and `matchExternal()` methods, which do not exist in version 6.0.8. This class was introduced in a later version of Spring Security (after 6.5.11). Without this utility, there is no mechanism to classify IP addresses as internal/external, and th...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.0.8-tuxcare.5" } ] }