{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a6d97e81-c65a-5e1a-b4d4-5ef931451b8b", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.5.11-tuxcare.1", "type": "library", "group": "org.springframework.security", "name": "spring-security-rsocket", "version": "6.5.11-tuxcare.1", "purl": "pkg:maven/org.springframework.security/spring-security-rsocket@6.5.11-tuxcare.1" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:92519900-001c-5def-8fa2-32b183648d4c", "id": "CVE-2026-22746", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22746 does not affect version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-rsocket. already_fixed \u2014 The target Spring Security 6.5.11 already contains the fix for CVE-2026-22746. The timing attack defense was implemented via commit a317a3d8663995daa2bc91593bb88ae2da21ea52 (April 15, 2026), which ensures constant-time authentication by always executing password verification even when account state checks fail." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.5.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3ce99db2-2f84-55af-bedd-f413690e939f", "id": "CVE-2026-22747", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22747 does not affect version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-rsocket. already_fixed \u2014 The target Spring Security 6.5.11 already contains the fix for CVE-2026-22747. The SubjectX500PrincipalExtractor class uses secure RDN-based DN parsing (via javax.naming.ldap.LdapName and Rdn) instead of vulnerable regex-based parsing. This is the default extractor used by X509AuthenticationFilter. While a deprecated class (SubjectDnX509PrincipalExtractor) with the vulnerable regex pattern stil..." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.5.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b832a3b2-a337-51e4-a835-5adb68d1aa8d", "id": "CVE-2026-22748", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22748 does not affect version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-rsocket. already_fixed \u2014 The target repository (Spring Security 6.5.11) already contains the vendor fix for CVE-2026-22748. The fix commits (68b820ed09 and 835d6c1fbd) are present in the repository's git history and are ancestors of the current version (d28d39bc5b). The code implements automatic issuer validation when using NimbusJwtDecoder.withIssuerLocation() and NimbusReactiveJwtDecoder.withIssuerLocation(), prevent..." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.5.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:435fcb62-5578-54f3-aa2d-68d6124fa3f0", "id": "CVE-2026-22753", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22753 does not affect version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-rsocket. not_affected \u2014 Version 6.5.11 is not affected by CVE-2026-22753. The vulnerability exists in specific code paths and classes introduced in Spring Security 7.0.x that do not exist in version 6.5.11. Version 6.5.11 uses a different, working architecture (RequestMatcherFactory) for retrieving custom PathPatternRequestMatcher.Builder beans, and the buggy classes from the 7.0.x patches (PathPatternRequestMatcherFa..." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.5.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e402c551-4df3-5fa8-84c9-3a952cb3bc1e", "id": "CVE-2026-22754", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-rsocket. not_affected \u2014 Version 6.5.11 is not affected by CVE-2026-22754. The vulnerability is specific to Spring Security 7.0.0-7.0.4 where PathPatternRequestMatcher became the default for XML configuration. Version 6.5.11 uses MvcRequestMatcher for servlet-path handling, which has a fundamentally different architecture and does not exhibit the vulnerable pattern." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.5.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:6c416795-8191-597a-b06c-0a1da4107178", "id": "CVE-2026-40988", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40988 does not affect version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-rsocket. CVE-2026-40988 is NOT present in Spring Security 6.5.11. The upstream vendor fix (commit 9d4d9065b4 by Josh Cummings) was included in the Spring Security 6.5.11 release, which TuxCare onboarded. The CappedOutputStream defense that limits SAML payload inflation to 1MB is present in all 8 Saml2Utils.java files. The vulnerable unbounded inflation pattern does not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.5.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c4407aa1-39c3-5d8f-97c2-1f8415159fc7", "id": "CVE-2026-40993", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40993 does not affect version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-rsocket. Spring Security 6.5.11 is not affected by CVE-2026-40993. The vulnerable class JdbcAssertingPartyMetadataRepository was introduced in Spring Security 7.0.0 (June 2025) and does not exist in version 6.5.11. Exhaustive searches confirm no JDBC-based SAML2 metadata repository implementation exists in this version. The only repository implementations are in-memory, HTTP session-based, and OpenSAML-based, none of which deserialize credentials from a database." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.5.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:71239bfa-2265-556f-94c8-f86ce1b4f806", "id": "CVE-2026-41003", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41003 affects version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-rsocket." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.5.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:b746b4f0-7be1-56d4-8b23-96a2f1880473", "id": "CVE-2026-41694", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41694 does not affect version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-rsocket. not_affected - Spring Security 6.5.11 contains the complete upstream fix for CVE-2026-41694: the signature is validated before decryption in BaseOpenSamlAuthenticationProvider and both logout validators. Fix commit cf0687120024 was authored AND committed by upstream maintainer Josh Cummings on 2026-04-30 and is already an ancestor of upstream Release 6.5.11 (73b077790fcb), which is the parent of our onboarding commit. No CloudLinux backport for this CVE exists on tuxcare-current/6.5.11. Corrected from already_fixed, see IRER-1226." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.5.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:4b587941-f4f3-5cec-a986-8c95694277b2", "id": "CVE-2026-41706", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41706 does not affect version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-rsocket. not_affected \u2014 Spring Security 6.5.11 contains the complete fix for CVE-2026-41706 (open redirect via CookieRequestCache). The fix was authored by the upstream Spring Security team (Josh Cummings, commit a14c9d66b1) and included in the official 6.5.11 release before TuxCare onboarded this version. Both CookieRequestCache.java and CookieServerRequestCache.java now store only relative paths in cookies, validate..." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.5.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:889c2aa6-c693-5498-9152-88e9199704d3", "id": "CVE-2026-41707", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41707 affects version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-rsocket." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.5.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:c064ef55-5eee-5b4e-af1a-bba24d37350b", "id": "CVE-2026-47841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47841 affects version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-rsocket." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.5.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:e2145e57-beba-5df7-b872-d4d903b038ee", "id": "CVE-2026-47842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47842 affects version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-rsocket." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.5.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:2fb1cd41-30d7-5072-9164-78748a29a3d0", "id": "CVE-2026-59270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59270 is fixed in version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-rsocket." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.5.11-tuxcare.1" } ] }, { "bom-ref": "urn:uuid:3d175b38-89a3-523a-88a1-d975d31f85c3", "id": "CVE-2026-59276", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-rsocket." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.5.11-tuxcare.1" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.5.11-tuxcare.1" } ] }