{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fcd7f457-b0d3-5cb4-9ada-26e48f79b3bd", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-rsocket", "purl": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3", "version": "5.7.7-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-security-rsocket", "purl": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7", "type": "library", "group": "org.springframework.security", "version": "5.7.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:0230a2d3-8127-5c7e-ae27-698760a537e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:f9d6111e-453d-512b-8d80-f294957d4799", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:80ab0493-52bb-5a96-b005-ec2f2e5f7f45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:4e801b55-89db-5ca6-9084-cf10c0ef30e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:759625d1-d16c-5f3b-b99b-665a93475437", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:9ea8cc82-78b6-526b-90fe-786ba5b306e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:30808e52-5b47-5854-8767-b74987816daf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:e20cf1f2-f9a5-5ede-a67a-bf5aa3e8e0be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:0ffbe739-e538-53d4-8825-402a9926cf64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:5abef5d7-6dcc-576a-8e28-31e873346b71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:f1b92e22-30a8-5128-a8a4-d2af220e1ab9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:f95c043b-6bea-5e92-a990-7c07bf43134f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:05123b64-8ef7-5960-8fad-84253ec314f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:d1097309-69de-584d-a7f1-451f8475ef1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:94249fbd-93cd-5271-b909-e7164a0a94d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:319997f1-79a5-57d7-91e3-74f9fc5f9481", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:4fa7b399-e7e7-5df0-bbf5-2c48f04743fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:daaf7b42-08e2-52e6-a58e-c913003994cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:c2abddfc-c7b4-532d-99b0-3028c0f50c3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:3ee12e44-a1c6-5b84-a4cc-0959bd0a0fd3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:b582ac46-ff50-59c7-8749-1411b9bee3c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:4b3a8c4c-afae-5491-8277-d156c845f700", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:357638b3-9c14-5109-ad56-06868d2404fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:f7b4dc51-9339-53cf-be89-d4e97e70d8cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:16bb1f97-2f42-5d1c-9dbe-4d480b4cc797", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:60a51a55-1388-5ff7-8c14-bbb0edf9858f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:bdfcd6c9-c4e5-570a-9e67-9177e1031f5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:bbc95edf-4c1d-5f76-9130-8e3d8ea32750", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2025-22234. This CVE is a secondary vulnerability introduced by the fix for CVE-2025-22228, which added a password length check to BCrypt that broke timing attack mitigation. The target version (5.7.7) never received the CVE-2025-22228 fix, and therefore does not contain the problematic code that causes CVE-2025-22234. The timing attack mitigation in...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:833fd62c-093b-540e-8630-df33d8b9bf4a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.7.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:513d5824-1839-539c-bd0c-c0f49775e76d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket. Spring Security 5.7.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:8adecdea-f1dc-53d5-9096-f93e7a55c9d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:072238bd-2cbe-5dc0-8057-04354bed0adb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-22751 because the vulnerable component (JdbcOneTimeTokenService) does not exist in this version. The One-Time Token (OTT) authentication feature was introduced in Spring Security 6.4.0, and version 5.7.7 predates this feature entirely. Comprehensive searches across the codebase found no JdbcOneTimeTokenService class, no OneTimeToken-related code...", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:34492ab5-ef3e-5d27-8fd9-172fa95f0169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:b17d4f0b-9b6e-5433-98cd-70b2d5983445", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ], "bom-ref": "urn:uuid:19ab0cb4-0eaa-563a-bc3a-3fc0e8a0f157", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.7.7-tuxcare.3 of org.springframework.security:spring-security-rsocket. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2026-59277. The vulnerable component, the InetAddressMatchers utility class with matchInternal()/matchExternal() builders for classifying IP addresses as internal or external networks, does not exist in this version. The CVE describes a misclassification vulnerability where 0.0.0.0 and :: are incorrectly treated as external addresses. However, versio...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@5.7.7-tuxcare.3" } ] }