{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7cc92621-14d0-55f8-a8b5-bfd427009202", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-rsocket", "purl": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5", "version": "6.0.8-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-security-rsocket", "purl": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8", "type": "library", "group": "org.springframework.security", "version": "6.0.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:8f27c38a-3721-5ce8-bae9-c9c968dc8028", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:8a42f4ef-f2f3-5bbc-9cf6-6c6a6e8d1ea1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:200d1c16-131d-5038-86d4-1eb2cbbdb50f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:772c0f9d-4b06-5ab3-b6fd-e2327bda0426", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:822ff33e-1d92-52d0-a466-a93337768e9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:1b8099fc-071c-5455-bec0-9899fc750a4c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:8d21eece-9986-5f0e-be81-a665e9346cd0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:18d0f062-fb4f-5dc3-8ba1-3d8ab1856d6a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:8ba2a77a-692d-5005-a739-2a8ea17d2118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:8a7c0da5-5104-551b-8da7-837d1d73753b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:f9aedd75-2e82-56e1-9592-b7105fa5c68d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:3212ec6d-b2f4-5927-8639-4ca2e5850bb4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:3668c581-f47e-51dc-8354-5180d0dabea3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:1079a8a8-7bf1-5227-a283-43c0d782a648", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:5ed5d77f-03ca-5ceb-b8e4-656033204995", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:1f9e24ca-3143-5346-baf0-0c53f71ac739", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:c8b2561a-a38c-53a4-a165-637c6bc45aeb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:c24968eb-e2ed-5a3f-8c86-dea9d772da22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:9906fd05-1097-58c5-a2a5-ee85ae2f8fbc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:c970a2e2-584d-5d9c-b4cc-ea42cc643588", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:cd14362a-f386-5405-8cf9-cfda540db916", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:8c01d0cd-3c4d-5557-914e-b49c78abd28c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:4784d77a-bd4a-5dc7-869a-053345126702", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:3dfcd413-1435-5695-91cd-efbe8fc58eb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:21ecc931-95af-5b77-bc7f-b6d1a73a8be8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:bdac9c8b-b6c2-51e0-aeb0-70a2a4d98955", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:712e91a3-6ac5-55d0-a4eb-02dd9129eaf9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:40cb2df8-3fd6-5c32-bfc1-aeff36e99292", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:caf389a5-57fb-56d4-b12d-e9107fa0d691", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket. Spring Security 6.0.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:0d192eb4-3c1f-5dbc-b76a-0fd218deadf3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:fe250024-372c-58c6-971c-3fca2e24093e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:94aa93a6-bb40-5458-ac4e-3995effa4423", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket. not_affected \u2014 Spring Security version 6.0.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire one-time token authentication feature) does not exist in this version. The one-time token login feature was introduced in Spring Security 6.4.0-RC1, released after version 6.0.8. Exhaustive searches across the codebase confirmed no OneTimeToken classes, JdbcOneTimeTo...", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:90b71416-4d80-5ff8-b635-f547d9c065c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:e7aca783-00fa-5bd9-846d-32f4543d97df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ], "bom-ref": "urn:uuid:897a78ca-6663-5559-8f78-6f3883b074e0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-rsocket. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-59277. The vulnerability exists in the `InetAddressMatchers` utility class with its `matchInternal()` and `matchExternal()` methods, which do not exist in version 6.0.8. This class was introduced in a later version of Spring Security (after 6.5.11). Without this utility, there is no mechanism to classify IP addresses as internal/external, and th...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.0.8-tuxcare.5" } ] }