{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:808a3af0-f3f0-5a0d-a6b4-27e88d033737", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1", "version": "5.1.5.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE", "type": "library", "group": "org.springframework.security", "version": "5.1.5.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2346e4d8-d603-5b37-aa8f-0f8a43378cab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4d28e155-e6ee-5c06-bf4e-27ac33fe310d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a70a7798-aafe-5b97-bcc2-2f5e7ced8f82", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:81bc9904-62b8-5961-a2b2-28b4fa69677b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a598b073-689f-5f79-aeec-1d57ca7a7f15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3589c254-5bb2-5044-9ad7-c1222f3ff49f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:903adb6f-1476-5298-878a-7f7f917a2af1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1d1714c3-f556-5d96-a832-eff87471e625", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f8a9ef2e-2c18-594b-85db-233e8c2ba2a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:40eddb6e-b7bc-567d-a129-34d01aa94426", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f7a780d1-81a2-52a6-bad3-e9a690959788", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1b7a0cf7-eb4b-5428-b571-0c55bf3cce0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:65ba9915-812d-53e0-984f-c1d7a62e4fba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:051f7bc4-1397-57ab-9446-4633e5c565c3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2019-3795 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 The target repository (Spring Security 5.1.5.RELEASE-tuxcare.1) is NOT AFFECTED by CVE-2019-3795. The vulnerability involved insecure randomness when SecureRandomFactoryBean#setSeed was used to configure a SecureRandom instance - specifically, calling setSeed() before any random bytes were generated would cause the user-provided seed to REPLACE the entire internal RNG state rather than suppleme...", "justification": "code_not_present" } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2a703e20-a82f-57ea-8d92-790b3ffb2605", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e0801d45-0093-5d36-9c40-d384ae5cc4da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:33af131c-b790-5f6d-b59b-6733fb576e68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:924819a9-67b5-5a5c-abe5-85be4348e5cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2c99c5d4-fc67-512a-abd4-364b9d39133a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7996524e-35c7-542e-937c-7cde574c5529", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:11490cb2-812c-5714-87b8-09cf07e63a71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e8a024c5-e625-51fd-8058-c1048840a5f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f11a7132-d2f3-56f6-9947-65235c2faf47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:63b50e5d-f626-5733-bc1b-928b62b017a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:20add582-1b13-5622-b95d-ff1fe18c5884", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:628e8c90-7124-5479-8abb-1e8fd38f2675", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0c92a80a-7a74-5aa8-883b-a8e88ab241d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:608fc1f9-ccc3-56e0-9397-c0698075831a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22223 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 5.1.5.RELEASE is not affected by CVE-2025-22223. The vulnerability requires @EnableMethodSecurity and the UniqueSecurityAnnotationScanner class, both introduced in Spring Security 6.0.0. Version 5.1.5 uses @EnableGlobalMethodSecurity with PrePostAnnotationSecurityMetadataSource, which relies on Spring Framework's ClassUtils.getMostSpecificMethod() to correctly resolve annotation...", "justification": "code_not_present" } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:801f1512-5532-5329-b4d3-0fa4e707c920", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Target version 5.1.5.RELEASE is not affected by CVE-2025-22234. This CVE fixes a timing attack vulnerability introduced by CVE-2025-22228, which added an unconditional 72-byte password length check that broke timing attack mitigation in DaoAuthenticationProvider. The target does not have CVE-2025-22228 applied, therefore it cannot have the timing oracle vulnerability that CVE-2025-22234 address...", "justification": "code_not_present" } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:50e6a53b-8487-500b-a828-9c7761a7e74b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 5.1.5.RELEASE does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ef79a384-0628-5ef9-b3e8-6e3081637058", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. CVE-2025-41248 affects the annotation lookup used by @EnableMethodSecurity. Spring Security 5.1.5.RELEASE predates @EnableMethodSecurity, which was added in 5.6, and has no such lookup, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:07d35b98-11cb-5d26-bac5-5627a2382b1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:746ddf71-bd37-5f0a-85c0-811a04f96090", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4611f914-041f-56af-9b46-b586deadbe2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:71b57702-9936-5b6f-84ff-022ff8ecbf82", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 5.1.5.RELEASE does not contain the One-Time Token (OTT) authentication feature. The vulnerable component JdbcOneTimeTokenService was introduced in version 6.3.x, several major versions after 5.1.5. The target codebase does not process one-time authentication tokens and therefore cannot be affected by the TOCTOU race condition described in CVE-2026-22751.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ef7e3fee-50d9-550d-be0a-9ee9ebb265c9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. Spring Security 5.1.5.RELEASE is not affected by CVE-2026-22754. The vulnerability exists in version 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean where the basePath() return value is not captured, and HttpSecurityConfiguration doesn't use bean-provided builders. Version 5.1.5 uses a completely different architecture (MvcRequestMatcher with property setters instead of PathPatternRequestMatcher with builders), and the servlet-path feature has worked correctly since its introduction in Spring Security 4.1 (2016).", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c148e7d1-7d48-515d-844f-1c4f160707a7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41706 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security version 5.1.5.RELEASE is not affected by CVE-2026-41706. The vulnerable classes (CookieRequestCache and CookieServerRequestCache) that store pre-authentication redirect URLs in cookies do not exist in this version. These classes were introduced in version 5.4.0-RC1 (commit 9708a2d63f). Version 5.1.5 only has HttpSessionRequestCache (which stores requests in HTTP session, not coo...", "justification": "code_not_present" } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:33e6f324-9272-5a62-abcc-ccfc502776e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47838 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:03f4449b-9522-5605-9dcc-d5ed39ac94d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47841 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:30030ab5-59de-5f97-8873-1525a065afa0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cde80ded-c514-5f5f-bd94-d5132319f40d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 5.1.5.RELEASE does not contain the InetAddressMatchers utility class that is the subject of CVE-2026-59277. The vulnerability concerns the matchInternal() and matchExternal() builders of InetAddressMatchers failing to recognize 0.0.0.0 and :: as internal addresses. Exhaustive search confirms this class, its methods, and the org.springframework.security.util.matcher package do no...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ] }