{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ef0a143b-59f3-5b17-8d7d-3ff12320b436", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1", "version": "3.2.8.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE", "type": "library", "group": "org.springframework.security", "version": "3.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c1500e4f-03c7-59fa-a6b4-0579c841df46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c7943b6b-dafa-5207-b7e3-c9fc5e800bcb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e606eaee-2e7a-51b3-a468-bf599d2da30d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:360704c5-a31a-50c9-996f-9625ca2c927b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:56279325-fd4f-5b4f-902a-b1017519ebaf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:25b0f81e-dc21-5f87-97f2-344a2925b3aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fb9d5750-957a-58c8-93c8-e9637ee08b98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:24315c87-90cb-582a-b791-64acd1cb6bbc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7356cb6a-6949-5477-89ae-6464c8242f04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:861bc5dd-ab6d-5bfa-b02d-a225e8a38aa0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:371ec309-1f52-5ca0-9707-2ee159d441a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d08be736-a668-531a-a16d-8c0e582b0b13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5485fab1-51a5-5cf0-a724-5f6d9edbcdc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2019-11272 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8da3fd3e-5064-500b-b95c-536424e8785c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:70182464-5b33-5060-850f-41d4f4b9a212", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b5840bdc-9d0c-560c-84b7-b307e14008fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d4e26d28-9da1-5e35-aeba-877ffedf59c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22112 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:589eb121-5aaf-5339-a1df-78f9270f358f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:75a80382-548b-5c25-8310-65c29a6e003d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:480cef70-8a9e-5715-848c-8db4050dee5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4ca967e7-f9ed-559c-9a53-38f8f7ef392a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d89ab683-ce4f-5d9b-b8fe-ada87d81bc52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9bd8e738-cbaa-5b02-9979-78047b789b77", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a3584829-eb2c-58bb-b0c7-0bcf3e65cdf1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:74bc304e-b2e4-5bff-a444-a441ab27f67c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fcf1ec7b-9353-5eaf-9f6c-3640b532fea5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38821 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2a037c4e-08d7-5937-92d3-741b712b9763", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3c82dbb5-18e9-51f4-89ac-c8acc8b2ed86", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 3.2.8.RELEASE is not affected by CVE-2025-22223. The vulnerability targets the modern method security architecture (`@EnableMethodSecurity` + `UniqueSecurityAnnotationScanner`) introduced in Spring Security 5.6+. Spring Security 3.2.8 uses a fundamentally different architecture (`@EnableGlobalMethodSecurity` + `PrePostAnnotationSecurityMetadataSource`) and lacks both the vulnera...", "justification": "code_not_present" } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9bd4bf17-ccbb-5cf0-a0ad-3eb22dab89ae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 CVE-2025-22234 is not present in Spring Security 3.2.8.RELEASE. This CVE is a secondary vulnerability that only manifests when CVE-2025-22228 is present. CVE-2025-22228 introduced a 72-byte password length check in BCrypt that inadvertently broke timing attack mitigation in DaoAuthenticationProvider. The target version does not have CVE-2025-22228 applied (no 72-byte limit exists in BCrypt.java...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4e21d7ec-c2e1-5855-b639-be3933e09792", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 3.2.8.RELEASE does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a930ef0f-ef20-566e-aed7-32d571cbdf02", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 3.2.8.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c46a4c3b-9f7f-5304-a0ab-d63e3525d5bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a2553123-2771-5a4a-9fb8-aa5bd27a4495", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fbe802e4-65d0-59f4-a3f3-0f3419d86766", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:89f82972-2ed0-525f-973c-0678d1049643", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 3.2.8.RELEASE is not affected by CVE-2026-22751. The vulnerable JdbcOneTimeTokenService class and the entire one-time token authentication feature do not exist in this version. The one-time token (OTT) authentication feature was introduced in Spring Security 6.x (circa 2021-2022), while version 3.2.8.RELEASE dates from 2015. The target repository contains no code that processes ...", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4379fdc6-161b-5b30-bba4-b47b96893bd9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. Spring Security 3.2.8.RELEASE is not affected by CVE-2026-22754. The vulnerability exists in the servlet-path attribute feature for intercept-url elements, which was introduced in Spring Security 7.0.0. Version 3.2.8 uses a completely different architecture (AntPathRequestMatcher/RegexRequestMatcher) that reads servlet paths from HTTP requests rather than configuration. The servlet-path attribute does not exist in the 3.2.8 XSD schema, and the vulnerable classes (PathPatternRequestMatcherFactoryBean, HttpSecurityConfiguration with PathPatternRequestMatcher.Builder) do not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:74acc4e0-975a-598f-bd63-43affe70ff94", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41706 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security version 3.2.8.RELEASE is not affected by CVE-2026-41706. The vulnerable classes CookieRequestCache and CookieServerRequestCache do not exist in this version. Version 3.2.8 only implements session-based request caching via HttpSessionRequestCache, which stores saved requests in HTTP sessions, not cookies. The vulnerability specifically requires applications to use CookieRequestCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:63dd4b6e-c17b-5bb2-852f-2145a9e0887e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47838 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f2122e1c-2010-58f7-b479-464a2ec3e7f4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 3.2.8.RELEASE contains no WebAuthn code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:eff7e2d3-06aa-57b6-b1c3-3d28e411eca3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e6e24521-a170-52be-bd23-0a7666c7a0ec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 3.2.8.RELEASE is NOT AFFECTED by CVE-2026-59277. The vulnerability requires the InetAddressMatchers utility class with matchInternal()/matchExternal() methods for classifying IP addresses as internal vs external. This feature does not exist in version 3.2.8.RELEASE. The target only has IpAddressMatcher for basic subnet matching, with no internal/external classification capabilit...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ] }