{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3b6aece4-076b-57e7-a701-b5be60ea3c8b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-test", "purl": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5", "version": "6.2.8-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-security-test", "purl": "pkg:maven/org.springframework.security/spring-security-test@6.2.8", "type": "library", "group": "org.springframework.security", "version": "6.2.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:6743697e-562c-5b96-8954-f4f73282274b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:0615bf3a-a4f4-53cf-9269-1f4d400e5605", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:018c46cd-6701-52c0-9f97-b75862295364", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:a9d32d06-611e-5c30-af91-fe7761a4231c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:9290d340-c28c-5521-80f5-fe83c124e783", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:5f7b80d0-70f5-599d-985d-99bb02fea0f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:983db805-da9e-56c6-8973-a89622537459", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:6b725780-404a-59c5-a0aa-5a4c6118cfff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:a2a1572c-9e9e-5b1e-8248-597486d01fd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ad828376-55e1-57e1-81dd-110e54954db7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:90a1d9bd-c0d3-512d-9a8d-d75add64d282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:87428100-e8ba-5ebd-a95d-053c83b66438", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:eba0bfa4-2770-5e86-9b5b-8782728f511f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:96fd7c65-8901-5a0c-b9fe-bbc253eed19b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ba244a5b-0508-5b00-a899-0ce309a9435f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:878da1fa-2493-5ea3-b8ef-a6443e959f30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:305faae4-cff7-5006-9d55-13b00cbec445", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:5ed60b7f-1a48-57ce-96be-99287e0f95b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:b1408244-f80c-500c-b171-52b74c721a2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:a7a1b781-538c-5226-9c62-a37d126cfa2f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:f9f0a971-818c-5f44-9ab2-77a35071530c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:6523e8ec-8520-5b78-88db-3cf8a0441697", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:13e68cb3-7a64-516f-9fa7-35bc21ffc612", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:23969658-7154-556e-8cc4-87579696e4f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:7195d93d-1c1d-5651-88d4-547bdf7e6f17", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:2eda8cd7-0472-56ad-983a-39852a765e2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38821 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:90567b14-2043-5aae-b6fd-0e137f9bdca4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:1bf4951d-d8bc-52a8-8fe3-35ef499867ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:a54b03bc-6fb6-5dc1-b06d-5a29262624cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:a8ebffc7-3dd7-52a3-b1d9-392c1721d244", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:7fb1180f-667f-5d6b-92b4-717d10d63035", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test. Spring Security 6.2.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:81006657-5735-5e44-8124-ad9c3758fcbd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:4b801d57-f70c-5521-a9b5-d3cbad4ec58d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:30fddc63-d1d8-5e4a-b2b6-6b4f62bea6b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:5cf27555-59d9-57dd-a0ac-6be846850ff0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22747 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:03aa1810-dfe4-5bf0-8130-433983664945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test. not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService) and the entire OneTimeToken authentication feature were introduced in Spring Security 6.4.0, which is a later version than the target 6.2.8-tuxcare.6. The feature does not exist in this codebase, therefore the TOCTOU race condition cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ba425a58-e125-5073-b40a-ed7470f49831", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test. not_affected \u2014 Version 6.2.8 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean, a class that does not exist in version 6.2.8. Version 6.2.8 uses a completely different architecture (MvcRequestMatcher with property setters) that correctly handles servlet-path configuration without the builder reassignm...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:732d574a-04bb-53bb-9565-c88a8abe43b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:e0b64f66-3908-5388-8f0d-0cea82eeed88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:3249b0ee-2229-538e-83a9-051e8f6eef56", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47841 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:fc967051-c1e0-5fbd-86c5-f78a3b26acce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:aa3197f5-c9de-5859-b426-894b77c95e75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:a017ebd3-0335-580c-aab3-1e3c1665a713", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-test. not_affected \u2014 Spring Security 6.2.8-tuxcare.6 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class with matchInternal()/matchExternal() builders) does not exist in this version. The CVE affects a utility class that classifies IP addresses as internal vs external for access control purposes, but this functionality is not present in 6.2.8. The existing IpAddressMatcher class s...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.2.8-tuxcare.5" } ] }