{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e11900f3-a468-52ca-9b99-0768e1c6c540", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-test", "purl": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2", "version": "6.0.7-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-test", "purl": "pkg:maven/org.springframework.security/spring-security-test@6.0.7", "type": "library", "group": "org.springframework.security", "version": "6.0.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:1c618212-0002-54a8-b5d4-14cb215c8952", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:3cf55e05-2b12-5422-93b6-d2f3b3807e5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:220be779-3f06-5325-a516-1eb5ba6996e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:233b8016-dd5e-5091-8062-3ea023905dcd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:fc1c5249-c096-5437-ae0c-fe799326c3ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:65ba2d6f-8660-5193-88a2-20a6710822fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:a3bfef32-ccc7-59a2-9cff-28058786ede6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:d7183334-225a-57fc-be62-020a9f3d66e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:59516a6c-94ec-5d2c-85c8-b8beaa8ed738", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:2ece13eb-ea88-5e38-97a2-16c591939353", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:ebc1cda6-bf08-5fc9-b08c-c5425d8acf12", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:10875081-74da-5922-bbd0-8416bdd89962", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:177100cc-80fb-5e2e-95c1-38ab657d67b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:2e40e5cc-7ce0-5bd9-bf53-2327e682f033", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:d56a6cde-3b96-5f88-9287-cd02735c6b35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:dac2e083-5a98-59d9-9e0b-52f44fac5c25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:0628b9e1-ab9b-5ca0-af6e-0e56074fa1a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:004ee92d-0042-5cf1-ade2-b5c0de9ea48e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:201bd73e-4580-55cc-bea7-3597ce98f35a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:b7f41b68-33d7-51b5-b1bf-d06d23ae2d90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:185b6dfe-2ad3-568d-a6ff-9268932ee0fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:d20a7735-163f-59e1-8545-f1837ee6ad6b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:00e2123f-94a6-5c98-a6ec-d92972df5d9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:42dfd4ee-fc57-58cf-86f1-45781e32f0c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:29f6c94c-bfff-5234-8626-fbefc681d7a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:fab03a02-ee24-553f-868e-0946f6b4ebf7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:5dbe6294-bd2c-5804-88b5-d6ca870cd290", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:cf99ff12-7f7a-5dcf-b457-8fcb1c2b11f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:bf657a3d-43da-5e8a-8b47-c63448001ee5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:418883c9-ccf9-5392-8f89-a26d51c7c41d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:4999a817-a5d6-5b6f-97d0-a6f5904c0931", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 6.0.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:7edba5b7-4480-57c5-931c-b9f37c3cac02", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test. Spring Security 6.0.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:5e146cae-2fed-5582-9fe3-f27b1440cf60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:da55b8b6-c4c8-56bc-9ffe-5e3c58358e5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:5cc8a67a-8996-5931-9d0f-49489e105852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:3d205f7f-f798-50b8-89ff-9b9139a73960", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test. not_affected \u2014 CVE-2026-22751 does not affect Spring Security 6.0.7. The vulnerable component (JdbcOneTimeTokenService) and the entire One-Time Token (OTT) authentication feature were introduced in Spring Security 6.4.0-RC1, which postdates version 6.0.7 by several minor versions. The target codebase contains no OTT-related code, classes, or interfaces. This is a Rule 5 Type A1 case: the INPUT type (one-time ...", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:ccfc4d1a-af05-5c31-8797-dd1d7bcddd59", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test. Version 6.0.7 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcherFactoryBean (introduced in Spring Security 7.0.0) where a builder reassignment bug causes servlet-path configurations to be ignored. Version 6.0.7 does not contain PathPatternRequestMatcher or PathPatternRequestMatcherFactoryBean. Instead, it uses MvcRequestMatcher for servlet-path support, which correctly handles the configuration without the builder bug. The CVE's affected version range (7.0.0-7.0.4) is accurate; this vulnerability was introduced with new functionality in 7.0.0 and never existed in 6.0.7.", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:9b21d155-6b51-5f0c-b122-714bb7a0a84a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:6dd4b077-2540-5218-acfa-2d837609f770", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:366989c7-b2f9-5d72-a0d4-109ef1f4862b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 6.0.7 contains no WebAuthn code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:5e7f4a84-0503-5670-a90d-170a0482cd5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:c6e2256f-6e42-554e-9807-70a89e15be41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:3e0dde53-6ba0-5c25-a0f4-062d6d3d32b5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-test. not_affected \u2014 Spring Security 6.0.7 is NOT AFFECTED by CVE-2026-59277. The vulnerable component `InetAddressMatchers` and its `matchInternal()`/`matchExternal()` methods do not exist in this version. The class was introduced in Spring Security 7.1 (confirmed via upstream @since annotation), several major versions after 6.0.7. While version 6.0.7 processes IP addresses via `IpAddressMatcher`, this class only ...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.0.7-tuxcare.2" } ] }