{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3d9b2a1f-8b0e-50ed-81bd-5d2ee210e68b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-oauth2-resource-server", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5", "version": "6.2.8-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-security-oauth2-resource-server", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8", "type": "library", "group": "org.springframework.security", "version": "6.2.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:2bcbd4bc-3bd2-5936-b448-0265c9dddbe8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:96df2bb6-dcbb-5dd6-a01e-724c4a6c36f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:98fc419d-a157-5e29-9b21-1588f8c96ebe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:487ddb2d-6bbb-5b48-b245-8839a517da7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:91ade123-73ee-5bd6-b2ee-016479822654", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:20afe25b-bf06-5134-96c9-2e8cd7637894", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:28a3b763-4b4e-566a-b08b-abd3f7c49325", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:a85a8c5d-d824-5a06-8cb8-2059bb03170d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:c0c19595-33d3-5793-a18c-6ae947bf1ab4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:b2fe1190-504b-5e08-91db-798c0dfba619", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:1f752e7e-d13b-5b87-8dcb-4c1e8631f605", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:b064ca0f-0af4-5c3c-8fff-0064539944f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:740e40ad-c644-5c7b-9491-47a1a71381d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:950f533c-0ad7-51f7-8336-449e1999cb78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:80e856fa-1b43-5120-9a20-14728d05f3ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:8257b5be-d8e2-5d7a-afbb-5de9e6150bdd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:793343fc-cda1-5c82-9cc3-dfd0f265d0a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:b18279c9-2b91-5234-9cac-82ce9208976c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:8736abb6-fb1e-53ab-a11e-1c3dd60d8e62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:c227ce15-2a00-5084-9c8e-bfb3cfd5fae9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ca770fd4-f565-5372-b4ce-2858e8391a1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:7b6bc7b1-7a04-56c1-91e9-428ff0ee91e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:3096a14c-352c-5930-aa9e-366c0da2da3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:10275083-0f86-5663-a33b-946770a95a8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:dc5f6ec8-e154-5768-b732-b7602e1094b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:c3df79c4-762f-5e2b-b78d-55c2cc95f8b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38821 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:faa25ebc-1184-58a9-8dff-6e25ddd048c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:68c2cbb0-b9ab-58b2-a87c-8f433c2ddd82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:1835022a-ab6c-56ad-b905-abf07b6a64ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:0665cfb5-f579-5d82-9409-99b0f278671f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:76ea7653-9dae-54f5-a336-b0bade8eeac7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server. Spring Security 6.2.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:4e04c8e1-8bf9-5aff-b5b7-c5575c7e8a67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:a4bfecc8-4aca-58a2-b29b-bf244226d139", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:37a555e4-962d-585f-8980-d6283dbfe55d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:abdd2d07-1bdf-55f1-86f6-bc1e6853a5ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22747 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:54d5e770-20fc-5141-a74e-61fc310cffec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server. not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService) and the entire OneTimeToken authentication feature were introduced in Spring Security 6.4.0, which is a later version than the target 6.2.8-tuxcare.6. The feature does not exist in this codebase, therefore the TOCTOU race condition cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:df303064-b1ae-53a4-a791-52b7a3b853d8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server. not_affected \u2014 Version 6.2.8 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean, a class that does not exist in version 6.2.8. Version 6.2.8 uses a completely different architecture (MvcRequestMatcher with property setters) that correctly handles servlet-path configuration without the builder reassignm...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ee57e034-da57-5eea-adba-966e1ae3cad4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:d5330331-316e-53dc-a47e-6106368c84e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:62780d8b-e9ff-5717-9881-de48cac40efe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47841 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:62e18518-7d40-5cf9-a05a-6efc85666ccd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:356a2e50-4625-545a-a16a-1f0b9496c9c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:79c29ddf-aa88-5e99-abe3-fd812d0a8097", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-resource-server. not_affected \u2014 Spring Security 6.2.8-tuxcare.6 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class with matchInternal()/matchExternal() builders) does not exist in this version. The CVE affects a utility class that classifies IP addresses as internal vs external for access control purposes, but this functionality is not present in 6.2.8. The existing IpAddressMatcher class s...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@6.2.8-tuxcare.5" } ] }