{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7eb6d60f-b4c5-57ff-a4b2-f02803ef6c07", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-rsocket", "purl": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6", "version": "6.2.8-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-security-rsocket", "purl": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8", "type": "library", "group": "org.springframework.security", "version": "6.2.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:3c0be928-84e9-5331-8d64-2c6ec29a41f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:8cafec10-8005-5b76-b34c-27ed5a22c040", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:57430985-1132-56be-961f-f09752342f0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:83875db9-0177-5d48-93ee-b59f493df2e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:f7f87ce6-d6cf-56cc-9ae0-b55d7c2ba83a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:235c3c7d-9d8b-5469-830b-ea9038bec2c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:4d0f4a20-db85-5910-beea-79d9c958896e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:01331f71-ddfd-5899-abed-32a05704cc47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:e1b2e677-9a24-53c0-968d-5a14d6560758", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:2a5702f8-c78a-540d-ac73-8810eb59ad71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:cf65b8bd-2b0c-58a9-94c4-e0dd82637c9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:016e2361-91e0-5e9c-a8bc-f11321cc1a18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:29b80323-9bfa-5934-9877-fa603d2912a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:92cf1f06-3b46-52ca-b874-dbdd93812bb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:b2fd5796-7e05-5664-9ab7-5b4edcdc0883", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:775043b7-077b-51ba-b9bf-bb154487240d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:71ad29b5-e686-55f3-b729-c7d840f5e0b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:5051d77e-0d17-5ee2-bb72-affc785c57c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:2b27e43d-b9cf-511e-903e-92a83f7d1327", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:5185abce-ebda-508b-8c19-0a92928729d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:0b299f96-a640-56c0-8ba2-efc67141e537", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:8676a65c-a885-5634-8b90-b63d46c426d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:a0d83631-25ff-590b-a2de-382e435eddca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:f91e5034-4cc0-504b-8e87-770488926cba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:92689d06-83a3-5b0a-b521-e0c7f7120abd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:ed5745bd-88b3-5c48-96cb-de10c69afcb4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:88f094f1-0ef8-5b2e-8a1c-1cd2e10db226", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:10804a79-338b-54de-8d20-9017a2457f60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:dcc48eb6-7182-5b75-897d-c759a936c2ca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket. Spring Security 6.2.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:a85c81c3-8f90-5e37-8539-3f6f006e31b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:d9c7f85a-396a-517e-854c-b34968c040ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:5072f945-ef1d-5d2f-9e5a-242dceac8aca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket. not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService) and the entire OneTimeToken authentication feature were introduced in Spring Security 6.4.0, which is a later version than the target 6.2.8-tuxcare.6. The feature does not exist in this codebase, therefore the TOCTOU race condition cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:dccac39a-ad2d-55e8-ae53-1367346c2f39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:c79d2123-9755-561d-b913-c0fd6b797b78", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ], "bom-ref": "urn:uuid:010c78a9-76d3-5efc-9720-a2d9d9478209", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.2.8-tuxcare.6 of org.springframework.security:spring-security-rsocket. not_affected \u2014 Spring Security 6.2.8-tuxcare.6 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class with matchInternal()/matchExternal() builders) does not exist in this version. The CVE affects a utility class that classifies IP addresses as internal vs external for access control purposes, but this functionality is not present in 6.2.8. The existing IpAddressMatcher class s...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.2.8-tuxcare.6" } ] }