{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4a34dbfe-5264-59bb-ab7d-23572fc50e9a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-rsocket", "purl": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20", "version": "6.3.10-tuxcare.20", "pedigree": { "ancestors": [ { "name": "spring-security-rsocket", "purl": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10", "type": "library", "group": "org.springframework.security", "version": "6.3.10" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:841b9773-f998-5591-9993-c596a042da1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:01dd5f15-5551-51a5-a7fe-581886a14e38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:d5c9955f-3bea-50c8-8444-04eb6a03c64d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:9af1408d-ccbe-5b56-a8f7-0e2f86e45220", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:12dd8cc3-e95d-5ade-8966-ca7db30acd66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:9b5222b0-93ef-5ad5-acb6-a860ddb400f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:377d9586-1c7e-5ce5-a858-6059069c0ed5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:7c2f766e-7496-5886-9f73-ebca51d848d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:7a4c3da9-5ff9-52dd-9517-dc92f709ef38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:24279add-b192-567b-bf0d-8ce16d247411", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:a33876b0-98c0-5a4f-92d8-d3d3f1d31f74", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:9dd93927-a335-54e8-a018-be5496fe3b53", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1258 does not affect version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket. not_affected \u2014 The target Spring Security 6.3.10-tuxcare.7 is not affected by CVE-2018-1258. The vulnerability existed in Spring Framework versions 5.0.5/5.0.6 and was fixed in Spring Framework 5.0.7 (June 2018). The target depends on Spring Framework 6.1.20-tuxcare.5, which is approximately 6 years newer than the fixed version and contains all security fixes from 5.0.7 onwards.", "justification": "requires_dependency" } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:ffe96025-27cc-56a8-ad77-d95e4a39ffe8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:09684930-5c4f-5af8-80f4-562f3e099e65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:423aebf0-bd34-55b9-92e3-e34e74727105", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:d01be063-a132-559a-99dd-c1c9b23fdf53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:07c64d14-5c1e-5aa0-8bcf-96b5a7d2c50d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:82d75c51-b9ad-5c16-a41e-39e9e466d280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:e4d17b83-9cb1-586f-8325-7de6b7c682d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:f3f04dc0-bc9f-55b6-94ce-c7dd70b1a63d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:01108438-2c3c-5eb9-9db3-e4a3302a0b76", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:68f88c87-261d-596d-8142-cff1543554a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:3657ed03-c321-5274-aab6-99ccd6989b76", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:996e55c4-d119-57e9-826d-0c6348ffaa97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:182ba0ae-e32f-5795-919a-670a5a0d6c03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:1512f7b9-4477-59f6-bda9-d3c5a0fcaadf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:f90cf140-1715-5d33-82bb-4fcf6baf4e2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:fe3edb61-809f-5543-b864-d4c37ba8a072", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:8b1242d4-8eec-5c7f-9df2-18c61617eb9b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket. not_affected \u2014 The target repository (spring-security 6.3.10-tuxcare.21) is NOT AFFECTED by CVE-2025-22234. The vulnerability was fixed by upstream Spring Security in commit c1aa99fdd2113a232986e9c3a44673ae752de840 (dated 2025-04-17) before TuxCare onboarded version 6.3.10. The fix conditionalizes the 72-byte password length check to only apply when encoding new passwords (!for_check), not during authenticati...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:54b437ef-7e07-50ad-9484-7c66724fd428", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket. Spring Security 6.3.10 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:7434aa48-e15f-5494-aecb-a47458a5daf9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:9b21398c-c097-513e-9c19-45ab28671188", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:51b743e0-67ce-5250-9154-9689b20b65ab", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket. not_affected \u2014 Spring Security 6.3.10 is not affected by CVE-2026-22751. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.4.0, which postdates this target version. The one-time token authentication feature does not exist in 6.3.10.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:f0ea456b-042a-5c23-8cd2-8aae2f3b6c24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:be4a2abb-3b29-5809-80e3-c60a19331548", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ], "bom-ref": "urn:uuid:99f85126-1f2f-5534-acfc-c13501c3278b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-rsocket. not_affected \u2014 Spring Security 6.3.10 does not contain the InetAddressMatchers class or its matchInternal()/matchExternal() methods that are affected by CVE-2026-59277. The vulnerability concerns incorrect classification of \"any local\" addresses (0.0.0.0 and ::) as external rather than internal. This functionality was introduced in a later version of Spring Security (patches dated June/July 2026, after the 6....", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.3.10-tuxcare.20" } ] }