{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8acb8eb7-95b0-5ca7-863f-63ceae276fd4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4", "version": "6.0.8-tuxcare.4", "pedigree": { "ancestors": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.8", "type": "library", "group": "org.springframework.security", "version": "6.0.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:a072269e-9312-58d1-888e-d849b2a94181", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:f3672029-89ad-517a-b383-ad6de9d8f0dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:9b06d079-d7df-560a-ac50-95508f65f41b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:851d22b9-dd29-52c9-bfd0-7442a549224a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:c4fa3cbd-5104-565d-8245-165f69c71dc3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:ef2b43e3-fa2e-5461-ad14-940049d85d12", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:a34e9053-cbb0-5501-bca4-0c45f8338cb1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:b6cd46e7-d12c-5574-9577-25757f67f93e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:6c84a929-ed21-59e6-90d6-dc9b8a534fae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:00aa66de-9309-5c64-a3e8-671650f1b702", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:31363e4e-fbd3-5b61-b8ef-fd75589daa7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:1617a218-205a-5132-95a6-456c0833c842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:79b3684d-6acc-51d8-a5bd-039b29db10aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:f59bf7db-fcb3-526b-8614-5ab73c46357f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:352dd630-9b55-5ea0-ab79-7184ecbd2bac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:4fa3ce49-b4f3-5471-a8c0-4983c2bca28f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:8df3ba21-5311-5fd5-b10a-324beda126b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:8c105bb4-7065-5a2f-b337-43e1f3717d12", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:dcfc69c2-2bc5-5a27-9cb0-ddd1d0425da2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:fb75d1f0-cc81-5344-b91c-2d67dd702766", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:74db78cc-d106-5f6e-a44b-e9beb0771b81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:a3f8f82e-2f56-5328-abbc-3f27682c3185", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:87a6d2f6-1b54-57aa-8e4a-c1cc08b4c1eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:e21cbea2-a2b8-54c9-b9d4-15e46ffda8a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:b32da029-757b-5e13-984a-2d39ed321cef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:e2d6a9d6-7448-5129-b8cb-cad69daa1e5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:c2d26394-c0f3-550c-9b58-4a13b38bf5e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:391fd5a1-4bc4-555e-8ab7-dae0e752a32c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:d279d0e9-71dd-59d3-accd-87b9be05ce52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:52df1b72-702b-5e88-a3f9-badd536a938c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:3cc6c5f3-c9bf-5757-8233-c1a54338aa49", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web. Spring Security 6.0.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:e3d26dad-9896-5550-bf0f-e9c6d92413c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:ed8bf421-ad86-58a9-ae17-53f2d91a5c77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:e74645fe-815f-5cff-afcd-9a01d5e4d802", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:84261b8c-5785-54be-89ee-e86530d76ef2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:b59d152f-1ab7-5673-b9bd-c564b8dcb997", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security version 6.0.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService and the entire one-time token authentication feature) does not exist in this version. The one-time token login feature was introduced in Spring Security 6.4.0-RC1, released after version 6.0.8. Exhaustive searches across the codebase confirmed no OneTimeToken classes, JdbcOneTimeTo...", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:6af03e58-918d-580e-a587-bb1e0408744e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcher (introduced in Spring Security 7.0) where basePath configuration is not properly applied. Version 6.0.8 uses MvcRequestMatcher for servlet-path support, which correctly implements the servletPath check and does not have the builder reassignment bug. The vulnerable code patterns from bo...", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:1721d534-de1d-57cd-ae82-13ca7f12d13c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:e40f2d41-a910-5679-968b-e77d139ed03a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:e2000346-9249-53c8-8be9-359375cad90e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47841 affects version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:0744a56a-c8e3-5553-a1af-635e449f9f7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:f7db2172-1aeb-532a-94a1-88c72f8b5f0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ], "bom-ref": "urn:uuid:d0a8b1a7-09d0-502f-9094-a5040877462f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-59277. The vulnerability exists in the `InetAddressMatchers` utility class with its `matchInternal()` and `matchExternal()` methods, which do not exist in version 6.0.8. This class was introduced in a later version of Spring Security (after 6.5.11). Without this utility, there is no mechanism to classify IP addresses as internal/external, and th...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.4" } ] }