{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:464b8708-3a42-5cef-b141-cd146f64ec1f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-test", "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7", "version": "6.4.13-tuxcare.7", "pedigree": { "ancestors": [ { "name": "spring-security-test", "purl": "pkg:maven/org.springframework.security/spring-security-test@6.4.13", "type": "library", "group": "org.springframework.security", "version": "6.4.13" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:87e8cf4d-2028-5386-aa37-dead2226a732", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:6188f7ca-5b28-5d35-b922-78b47ca0e50c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:f9b30c67-e6a5-5ea6-b6e7-cb1a73839024", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:03910a69-54ca-5c68-9bea-e366f9b9a919", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:d5f7f695-ee1c-5d2c-a450-169edacc850c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:03408b43-948f-557e-bc52-87e6fb2115d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:c144b72f-78a9-5899-8973-ade48a405690", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:5f78f925-bd9f-5d1f-9e0e-aec390da13ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:a98096d5-19d2-50d7-b50f-4a71470d891a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:21f1bbc6-c839-57a1-b62c-de4b110c5a83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:aa4d0a7c-87ee-586c-8a83-565b96ecfefd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:91fa2504-3188-5e55-b436-8c3550e55a1a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:6eac4ecc-7775-566e-b461-5d2bf75cde95", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:1715ca5f-b7ef-514f-b65f-e42eeea26d32", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:4b7870d0-6a55-570d-8bd1-c683f32809c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:4a374722-7412-524f-b182-7ada8c3a82fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:cbed628b-e01d-5904-ac5a-f634397b268e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:eca9a49b-3bc8-5217-b17d-70b7b5fbcad5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:74feb525-db72-5597-a07c-bf39abe55b45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:0eca614f-412d-582e-ba5c-90a70a0f234a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:cb5be820-95d0-5821-9ebf-9b5832912f9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:a3ca9791-31c1-5fef-8ed4-5be433830284", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:f3d4e001-7355-5546-873e-10099e043164", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:57197e37-76ab-59b6-ae20-2dd3fb90560b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:36a84ce0-4f4c-5f40-9ecc-c345ec556a6a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:0e3901e2-b254-5786-9a98-eb2abdb13e02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38821 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:561ab8eb-a206-5af0-99bf-a47b9c02d067", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:6e98add5-92ff-5ede-87fa-ef6de9d07d7a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test. not_affected \u2014 Spring Security 6.4.13 is not affected by CVE-2025-22223. The vulnerability (incorrect annotation location on parameterized types causing authorization bypass) was fixed in upstream commit dc2e1af2da by Josh Cummings on 2025-01-08. This fix shipped in the upstream 6.4.13 release that TuxCare onboarded on 2026-07-17. The target contains the complete fix at lines 215-261 of UniqueSecurityAnnotati...", "justification": "code_not_present" } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:137ac430-0165-5c79-a11f-23185b96a6ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:88998e01-c032-53a7-a910-848fa85cb922", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test. not_affected \u2014 CVE-2025-22234 is NOT present in Spring Security 6.4.13. The vulnerability (broken timing attack mitigation caused by unconditional BCrypt 72-byte password limit enforcement) was fixed in upstream commit c1aa99fdd2 which shipped with Spring Security 6.4.13. The fix modified BCrypt to only enforce the 72-byte limit when encoding new passwords (!for_check), allowing password matching to proceed n...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:42481098-de3a-52b8-9a09-71e26fb54a16", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test. Spring Security 6.4.13 already contains the fix for CVE-2025-41232: UniqueSecurityAnnotationScanner compares methods with equals(), so annotations on private methods are found (fixed upstream in 6.4.6).", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:ecaf124a-6dc9-5490-bd77-db1cca70ced4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test. Spring Security 6.4.13 already contains the fix for CVE-2025-41248: UniqueSecurityAnnotationScanner resolves generic parameter types with toClass(), so annotations on methods in generic superclasses and interfaces are found (fixed upstream in 6.4.10 and 6.5.4).", "justification": "code_not_present" } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:f2a23f53-0a16-5889-a572-809a5981a531", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:38f81d01-be0c-575a-a231-1224c68f1de8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:6bad2f58-24bb-52cc-9283-65a2462cdf38", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22747 does not affect version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test. Spring Security 6.4.13 is outside the affected range (7.0.0\u20137.0.4). CVE-2026-22747 affects the DN parsing logic in SubjectX500PrincipalExtractor, which can incorrectly extract a username from a certificate subject. This class and its associated authentication path are absent in 6.4.13, where X.509 authentication uses SubjectDnX509PrincipalExtractor instead. Therefore, the vulnerable code path does not exist in this version." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:5ab6d381-cc6e-50a7-ba17-57c24cf76548", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22751 is fixed in version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:2e5db6e0-ec94-5dc9-8624-14f8c437c1b9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test. not_affected \u2014 Spring Security 6.4.13 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a bug in PathPatternRequestMatcherFactoryBean where the builder's basePath() method is called without capturing its return value. Version 6.4.13 does not contain PathPatternRequestMatcher or PathPatternRequestMatcherFactoryBean classes. Instead, it uses the older MvcRequestMa...", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:50b54373-736d-5339-813f-13385e792ce6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:66525a21-8f3c-5d7a-aeb4-cfbe90a9c0e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:b75c7310-fd39-5e55-b800-73ca28418940", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47841 is fixed in version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:da4d4c33-8d2f-5a0a-b193-80fd5018847c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:248b7e40-b1bf-53d2-9cd3-73726d553265", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ], "bom-ref": "urn:uuid:2525bf9b-1d49-5bcc-9f8a-35a8f2814589", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.4.13-tuxcare.7 of org.springframework.security:spring-security-test. not_affected \u2014 Spring Security 6.4.13 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class with matchInternal()/matchExternal() builders) does not exist in this version. Exhaustive searches confirmed the class is absent from the entire codebase, including all tracked branches and tags up to 6.5.11. The InetAddressMatchers utility class appears to have been introduced in a lat...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-test@6.4.13-tuxcare.7" } ] }