{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3618ff19-89a3-5841-8d21-fc1b3c6f457c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2", "version": "6.0.7-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.7", "type": "library", "group": "org.springframework.security", "version": "6.0.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:15d7ddf6-3159-5003-a7a7-bf652b8a9f0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:718292c5-4868-569a-aba5-30dce3588bed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:56558843-0504-552a-adb8-7785181f9873", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:d83c8c03-0ff8-50be-bccc-001258acfb18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:d56ae2ce-6525-5f5b-a3e8-fcd4b478d061", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:a0b4d921-726b-5015-970f-afca12787f54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:31710dcb-d0c1-5451-95a5-ad6a5295d565", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:0bc86b75-74b4-5152-97f2-b0a41633beb0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:5cdc5b26-65a5-52c3-8339-f7799c431bc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:d139ac51-f112-5ec6-ab9b-a3a14f361329", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:ecf0062c-ca38-5d11-92e3-948af309dfda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:915bfa1f-e552-5762-8e8d-526ef908b8d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:c9ab7a88-f101-5b78-875d-dab5f03629f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:ec88eede-da07-59a4-a9ae-cbb498cd745b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:11a246a6-3e0c-5b13-8901-4565f4321d8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:04ba1730-f1d9-5dfd-a93f-2f88205374f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:87fa826b-72d1-5573-8fb9-4b248723ed20", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:b24ca96e-4d66-588a-a46b-8867def06745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:14875925-99da-50e5-885b-5311762ecf2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:34ac6e99-af6f-56f3-b354-e5fbad6c25a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:652f5e15-9078-5fa2-9e29-2bfc02877fb7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:4724dffc-2442-571a-b503-9fb95e42bd07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:985fd28b-0c1d-5b74-8ec1-81e230b4e797", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:3cf4e34b-7b71-53e4-a97d-bb16a587a6de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:a19f37f8-55f7-5021-a9bf-197d51fa5c61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:6daaa12c-42f4-593a-8d20-660fceeecbf9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:dce97739-f958-535b-ac8d-5b6ba11905d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:b52eac51-a3d5-5ca5-993c-3bdb9239513e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:2c88e035-e391-59b4-9c20-13eebfd4a553", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:c5c1d5d8-10d9-53a6-9220-b31f1840f07c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:cc982996-4ca9-504a-bcfc-d9f92736f7ea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web. CVE-2025-41232 is in UniqueSecurityAnnotationScanner, which Spring Security 6.4 added for method security in AspectJ mode. Spring Security 6.0.7 does not contain that scanner, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:fcfcca30-30ed-5b51-abf3-e6773c82f9e2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41248 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web. Spring Security 6.0.7 has no generic-type annotation matching of its own: method security looks annotations up through Spring Framework's annotation utilities, so the CVE-2025-41248 code is not present. The equivalent issue in Spring Framework is tracked as CVE-2025-41249.", "justification": "code_not_present" } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:d05b84b0-97dd-59ed-95a9-df056a2f7b9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:c22304f6-99b4-58b2-bc50-d63ce9a56269", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:5e7d0a7a-c4f8-5e22-bb90-f5290ccecc2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:425a1d21-d1db-589a-a69b-d7d39586a5b4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web. not_affected \u2014 CVE-2026-22751 does not affect Spring Security 6.0.7. The vulnerable component (JdbcOneTimeTokenService) and the entire One-Time Token (OTT) authentication feature were introduced in Spring Security 6.4.0-RC1, which postdates version 6.0.7 by several minor versions. The target codebase contains no OTT-related code, classes, or interfaces. This is a Rule 5 Type A1 case: the INPUT type (one-time ...", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:0ebc3aa0-617c-5eb0-9f67-3164bc80ab68", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web. Version 6.0.7 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcherFactoryBean (introduced in Spring Security 7.0.0) where a builder reassignment bug causes servlet-path configurations to be ignored. Version 6.0.7 does not contain PathPatternRequestMatcher or PathPatternRequestMatcherFactoryBean. Instead, it uses MvcRequestMatcher for servlet-path support, which correctly handles the configuration without the builder bug. The CVE's affected version range (7.0.0-7.0.4) is accurate; this vulnerability was introduced with new functionality in 7.0.0 and never existed in 6.0.7.", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:829276e0-d0c0-55b6-912d-2fdd5453217c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:113b4b9b-d4d7-50be-a8e4-8a54085870c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:d596fbef-8da2-582b-a818-487980a73e0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47841 affects version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:90f2f96e-7b90-56f6-9677-bae37b71d4cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:d46666d1-3dbf-54ba-a76c-c0a114f56c39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ], "bom-ref": "urn:uuid:f90baa5b-ab74-5e63-b0ae-4a6a04267a73", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.7-tuxcare.2 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 6.0.7 is NOT AFFECTED by CVE-2026-59277. The vulnerable component `InetAddressMatchers` and its `matchInternal()`/`matchExternal()` methods do not exist in this version. The class was introduced in Spring Security 7.1 (confirmed via upstream @since annotation), several major versions after 6.0.7. While version 6.0.7 processes IP addresses via `IpAddressMatcher`, this class only ...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.2" } ] }