{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:53d5c8da-e69b-571d-8917-23f5a1a7f0a0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-rsocket", "purl": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18", "version": "6.3.10-tuxcare.18", "pedigree": { "ancestors": [ { "name": "spring-security-rsocket", "purl": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10", "type": "library", "group": "org.springframework.security", "version": "6.3.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:db20ef63-ef6e-58c2-b969-f59e4abb0dc5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:ae2c7441-4d1c-5e89-8c84-ae24517e7bf0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:494d7ed0-53f7-5dec-83c6-1e29e5574c49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:2c206ef6-3808-5d98-9858-ea9ed64ffbda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:89ec7679-4e39-57a5-ba81-677bd1802807", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:56fb6907-e586-56ce-922d-01c329d5e7e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:4081d571-80a9-5d78-93e1-6890d7f08cec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:1a5ffdda-ec95-54a5-a741-e59052e297e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:122d8ae8-2c89-53d2-bbc7-9e98bcbc03ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:a7e3e0d3-6922-5120-9e94-7027d9401178", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:cf4f2330-a868-5d48-add9-45542d72f45c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:8902e499-bac0-504a-b5bd-640192ce816b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1258 does not affect version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket. not_affected \u2014 The target Spring Security 6.3.10-tuxcare.7 is not affected by CVE-2018-1258. The vulnerability existed in Spring Framework versions 5.0.5/5.0.6 and was fixed in Spring Framework 5.0.7 (June 2018). The target depends on Spring Framework 6.1.20-tuxcare.5, which is approximately 6 years newer than the fixed version and contains all security fixes from 5.0.7 onwards.", "justification": "requires_dependency" } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:b49945c3-cb53-565a-9565-23b2f34fa39b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:c9428660-7205-5c1f-a80b-7edd583f8eb7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:313274a7-78d4-557a-9144-f9eb1d1c1ea5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:ca9412a6-7766-5a99-b6f3-893ec703742f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:bcb035d3-b5c2-570a-8a4f-7184ba2266da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:4a88ea55-30d6-50da-b261-43037f232fa6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:ef78dbee-187e-5bda-bc90-69eef8231bde", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:c85ade17-5183-59cf-b7d0-9d5ee00eec81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:9d6cd7ca-c5a0-53f8-b0ef-3b0968722fd2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:9f1bb4fc-9e30-5b1b-ba85-f419355483b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:c30d2f5e-1376-5b02-9c03-04a29f04f20b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:232c7cca-d95c-57b3-9e90-ffbe690202d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:a861ea31-4041-598f-9d96-91d508cc6d6a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:b00a268c-6f2a-560d-a286-48c5d91ed847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:97d5890f-48fc-5014-9de2-33f079b92453", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:5b7ac567-cb49-5767-8c77-5ea17cbc73f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:7cdb0178-aadb-5d34-9f64-6c6aaa453533", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket. not_affected \u2014 The target repository (spring-security 6.3.10-tuxcare.21) is NOT AFFECTED by CVE-2025-22234. The vulnerability was fixed by upstream Spring Security in commit c1aa99fdd2113a232986e9c3a44673ae752de840 (dated 2025-04-17) before TuxCare onboarded version 6.3.10. The fix conditionalizes the 72-byte password length check to only apply when encoding new passwords (!for_check), not during authenticati...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:0b13b20e-a961-5ae6-8d57-343e24e6c292", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket. Spring Security 6.3.10 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:c920ae10-d4d0-5d81-9159-779653214506", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:63745eab-e030-5e95-8f05-f019cab5d472", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:1f036e0d-5ea4-5f67-9596-353895af8ccd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket. not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.4.0, which postdates this target version. The one-time token authentication feature does not exist in 6.3.10.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:d49bc827-ff1f-559e-81ed-66dad281c142", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47842 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket, and is fixed in 6.3.10-tuxcare.20." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:8e408d2f-675a-5187-b7fc-4d6db00b055d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket, and is fixed in 6.3.10-tuxcare.20." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ], "bom-ref": "urn:uuid:fdd33440-01a5-5c8a-9c90-754047a1f097", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.3.10-tuxcare.18 of org.springframework.security:spring-security-rsocket. not_affected \u2014 Spring Security 6.3.10 does not contain the InetAddressMatchers class or its matchInternal()/matchExternal() methods that are affected by CVE-2026-59277. The vulnerability concerns incorrect classification of \"any local\" addresses (0.0.0.0 and ::) as external rather than internal. This functionality was introduced in a later version of Spring Security (patches dated June/July 2026, after the 6....", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.18" } ] }