{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a76f2ec2-965d-5323-807c-8bb4f1457267", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-test", "purl": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1", "version": "6.0.7-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-test", "purl": "pkg:maven/org.springframework.security/spring-security-test@6.0.7", "type": "library", "group": "org.springframework.security", "version": "6.0.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:229ba2c8-f93e-50fe-817f-084313632180", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:cb8d495d-d255-5574-b296-968c100636bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:dc60d1dd-2c70-5cdb-807d-acd46768543a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:6ce3b349-5d8a-519a-a8ac-762d4374a7c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:cab452fe-f979-576b-9068-27d390355ac1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:62f14256-e3ed-56fa-b002-0b580fbd4f4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:4016ee4f-3491-5239-a5a5-52c3c0fd9fd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:81749968-82e8-50b1-aafc-52dff093a0c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:0eb4d91e-b0d4-517b-b192-376c2d645d44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:32e4664e-4892-5856-8bef-1cd70a87def8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:bd353d6b-da5a-5e96-a0d9-6619315e8e4f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:4af5d558-4819-5f28-9947-aad6653a1159", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:50d6da83-1ac8-55fb-a02e-8d22f3ce0eb8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:d8c224e0-af69-5df7-9b74-797378235a88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:cf2c1e89-e832-57dd-bdc2-c48a75a9fdee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:0c9a2c90-cab4-57b5-b5b8-9e19fde756bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:48fff7b1-09ff-5d46-b365-07c17ad14315", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:ba1dc0a8-5a15-57f8-b788-68a091560ff2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:583c8777-86f4-5531-9de1-d024b1663523", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:2279d5d1-ee6a-5503-9700-75eb9e56308e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:51e53613-1df4-50f9-95d4-f6f2855f4d1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:3a052022-a03e-5a71-8ee2-2d46b93eb6d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:724449a6-c2ee-5479-b1ae-7fdcc4be3120", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:a5c67dd9-0323-56a6-b62a-da590d848e14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:6a5fa462-3c10-5b72-bcfc-725096d09d43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:c9449ba3-1205-5436-821e-63e203113807", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:a60e9771-5df6-5c2e-88f2-6144be8a287f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:295b8f4b-9b4b-5a28-85b2-6d98e75cd5d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:6284256c-e179-58c6-8845-76b51e9a7eb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:dd08d9d5-c122-5b7f-90ba-af6b7ee737de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:e014da70-152c-5c15-9792-573bba1f9315", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 6.0.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:f966eb52-278f-59b0-a1b5-4aef758f6240", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test. Spring Security 6.0.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:351fd492-68d9-5b75-9fac-348d2d71b148", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:477b8247-a7ec-5de5-b06d-e3e0e0c72b72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:24841d86-4873-59de-aa09-00ee1c017809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:5c8ea5c1-482b-58ac-89c0-c7753b61cc1e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test. not_affected \u2014 CVE-2026-22751 does not affect Spring Security 6.0.7. The vulnerable component (JdbcOneTimeTokenService) and the entire One-Time Token (OTT) authentication feature were introduced in Spring Security 6.4.0-RC1, which postdates version 6.0.7 by several minor versions. The target codebase contains no OTT-related code, classes, or interfaces. This is a Rule 5 Type A1 case: the INPUT type (one-time ...", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:f831d267-8a4f-543c-8492-b3b83e1b95f6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test. Version 6.0.7 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcherFactoryBean (introduced in Spring Security 7.0.0) where a builder reassignment bug causes servlet-path configurations to be ignored. Version 6.0.7 does not contain PathPatternRequestMatcher or PathPatternRequestMatcherFactoryBean. Instead, it uses MvcRequestMatcher for servlet-path support, which correctly handles the configuration without the builder bug. The CVE's affected version range (7.0.0-7.0.4) is accurate; this vulnerability was introduced with new functionality in 7.0.0 and never existed in 6.0.7.", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:854bd7af-25c9-5f1c-bfed-672661fd02af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:6b4cbcd0-c524-5321-b505-66b7d0dcfde9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:89ee30f7-e2cf-5d4a-bb21-c3636a8fb81b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 6.0.7 contains no WebAuthn code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:f2319e35-70fb-5ae7-ad5a-3fce7caa1e03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:ca5ba7ef-550f-507a-9356-6e8cee55324e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ], "bom-ref": "urn:uuid:e1d85439-5a23-5f4e-a628-2ff02567abc6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-test. not_affected \u2014 Spring Security 6.0.7 is NOT AFFECTED by CVE-2026-59277. The vulnerable component `InetAddressMatchers` and its `matchInternal()`/`matchExternal()` methods do not exist in this version. The class was introduced in Spring Security 7.1 (confirmed via upstream @since annotation), several major versions after 6.0.7. While version 6.0.7 processes IP addresses via `IpAddressMatcher`, this class only ...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.1" } ] }