{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d822c06d-ddb6-5947-b934-75697da58be5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-rsocket", "purl": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4", "version": "6.0.8-tuxcare.4", "pedigree": { "ancestors": [ { "name": "spring-security-rsocket", "purl": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8", "type": "library", "group": "org.springframework.security", "version": "6.0.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:0f723255-7aa4-5f15-af29-9fd11bd68db1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:ae8e6af8-c903-50e8-a803-a7e3626695c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:31d6f65f-e2e3-5b86-8a49-310f71527be6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:6f261b1f-6f0c-5f44-8c20-9718ae3810fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:5b5ebac7-76f3-5573-8d07-686b109dd8bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:2245511a-f29b-5d44-a566-505377bd9af7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:1b9cd011-96e9-5adf-a055-e416c8a7d6ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:92219c27-daf8-564d-b11c-be26a6116394", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:3a4a02d5-afad-5e71-8d12-b81fc23bc72b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:ef9ae34a-d9b4-5b13-904a-93bd31d4b419", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:54a2c067-4e9e-5b05-a064-3a039393c5ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:d5167895-928a-5de0-a77b-2aa9a8be6e51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:20794c01-dacf-53be-b204-ff51acb28bd1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:87f2f340-8d0e-51ba-9f58-ec95bd6b7b73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:b1c5f35c-0c1c-5331-b123-d51794dc4a55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:b7d4ce0c-663a-5c4e-9f23-ba0e48ba8f51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:efd244ff-e698-5a6a-9b44-666e74b4de08", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:8e85a13b-bc58-592c-8aef-bb27b57dcca9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:65889dbd-dc5c-5ee1-81b8-5b0b4cffc90b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:012638be-3d46-5dd8-8813-af16d33b4592", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:227bbc84-a8de-5de3-b7ca-4ac66c40b4ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:96636f6d-9d70-538f-903b-db05e7b0c54a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:56a6d9d9-dc6f-5ce1-b87f-51dbcd64e315", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:14df9a67-f382-505f-9e66-24aad9e19f16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:6201f5b4-b42c-5e01-abe6-031adae0731b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:24c8732d-82df-506c-8e74-d1a3b267716f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:251d5907-62c2-5472-a5af-cb4a1dd96b25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:f0f840c5-484d-5a5f-9252-2c50b220e2c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:16aaa433-614f-546b-97ba-81583f7e4f6f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket. Spring Security 6.0.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:3bfd917f-7e19-530c-87f9-e08bb1970116", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:883f198e-7c92-53c9-a4e9-29ca8263f327", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:08d88a14-a21b-51d5-907b-0fdb8aec96cc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket. not_affected \u2014 Spring Security version 6.0.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire one-time token authentication feature) does not exist in this version. The one-time token login feature was introduced in Spring Security 6.4.0-RC1, released after version 6.0.8. Exhaustive searches across the codebase confirmed no OneTimeToken classes, JdbcOneTimeTo...", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:2ab1448c-ee92-5bea-a000-c1f892b79b63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:7b1cc6bb-4be4-5054-9b88-22a023903e25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:def1438f-f4df-5220-bc0b-33d456cf046d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-rsocket. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-59277. The vulnerability exists in the `InetAddressMatchers` utility class with its `matchInternal()` and `matchExternal()` methods, which do not exist in version 6.0.8. This class was introduced in a later version of Spring Security (after 6.5.11). Without this utility, there is no mechanism to classify IP addresses as internal/external, and th...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.4" } ] }