{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8906ca25-908d-5468-983d-b52454a597e8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5", "version": "6.2.8-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@6.2.8", "type": "library", "group": "org.springframework.security", "version": "6.2.8" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2010-3700", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:6f612971-6108-5a1e-aab9-82b146af32f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2010-3700 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2011-2731", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:d1941c83-8d0a-5f39-987c-cbe1f8596c04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2731 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2011-2732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:6f44dc88-191d-5c45-8bd1-d7c12355861f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2732 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:46a9a955-a1c1-5d0e-b1cb-7c605c6c950b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2012-5055", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:e3d648c0-b763-59a3-999b-d112a41e40d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2012-5055 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2014-0097", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:3a3df388-cd98-539c-889a-ad15156c65a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0097 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2014-3527", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:738cdb2d-a466-5605-a203-242076264c3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3527 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:73b10e30-7d8e-5fe1-9014-bfc27338f424", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2016-9879", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:7571728e-ec49-5382-8ffe-fee688f029b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9879 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2017-4995", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:89cae6d5-f169-5b43-8d96-ff7d644f0ac8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2017-4995 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:25b64751-2a3a-57f3-8266-f10cb54cc51b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2018-15801", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:7a63dafc-f43c-5df6-bc31-78c5796538fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15801 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2019-11272", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ae1fbfe1-2983-5bd1-912d-a02e801c3ab7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-11272 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:f8125b9b-9524-516a-80b8-e3cd5512ac15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2020-5407", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:e15f13df-d962-55e4-b58f-6340b6fd082f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5407 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:8deda09e-dc0e-5e7a-b159-b8588f524d93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ed0cefff-d5e6-5cf2-887f-8ea339f9aa93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:83c4f018-daaf-555b-aca9-60135a08ee72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2022-22976", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:cbfaefa0-2deb-5d8a-a3ec-e7170cc7fc14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22976 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:fab5183e-069e-53f2-9068-df9b644cf240", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22978 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2022-31692", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:0576f586-920d-5f47-a323-8a3734c8d987", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31692 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:def8c3f1-4e68-54ae-9875-bd425f03669b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:c3c929eb-2850-5714-a108-4aec4460bbd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22234 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:4e699be4-b2dc-52f0-b48e-146e6c615f32", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-38810", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:9f506e39-7206-5fd6-8183-8da646736a8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38810 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:b01ac2c3-c49b-52f5-8c1b-39f9cdf112bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38821 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:49e69e51-000d-55a9-a7d8-214e10819b06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2025-22223", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:a4bca347-1c41-5887-9571-aee0f070ddd7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22223 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:06e151a3-ce4b-51ec-ba4b-9a96ad79c4a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:02004735-6e2d-56c3-9567-c166279cb7cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2025-41232", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:1d9ace77-cad3-5385-83c3-23d19fa5a72b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41232 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web. Spring Security 6.2.8 contains a copy of the pre-fix method lookup from a TuxCare backport, but it is only used together with Spring's own annotation lookup, which finds annotations on private methods, so the CVE-2025-41232 authorization bypass cannot occur.", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41248", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ddacf626-e86c-5f41-851f-8e8890b52277", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41248 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ecdaee37-8505-5b5f-bc7e-b7d96a0af6a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:46db373e-857e-522a-b035-8adea7cc0497", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:a5f5d7cd-a924-5884-a2d3-ef1a031d6e1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22747 affects version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:ef54ba69-2ff2-50f3-b4bd-f7af7b23b236", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22751 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2026-22751. The vulnerable component (JdbcOneTimeTokenService) and the entire OneTimeToken authentication feature were introduced in Spring Security 6.4.0, which is a later version than the target 6.2.8-tuxcare.6. The feature does not exist in this codebase, therefore the TOCTOU race condition cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:a05f4351-ca13-564d-81bf-f0b416dce0bb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web. not_affected \u2014 Version 6.2.8 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean, a class that does not exist in version 6.2.8. Version 6.2.8 uses a completely different architecture (MvcRequestMatcher with property setters) that correctly handles servlet-path configuration without the builder reassignm...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:1799ff09-4c39-509b-bd76-512687f7e86c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:bb903d60-6f30-5f00-9d53-30416d195cec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:88f85150-82ff-57fb-97b6-1c3d23a25eba", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 6.2.8 contains no WebAuthn code, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:0d0711a4-ec44-5147-a6fe-c763ee0be322", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:c0b39be1-632b-500c-9809-4bbf56180ee9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-59277", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ], "bom-ref": "urn:uuid:a3b79b62-87df-5d4e-a7d2-05f4edce4de4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59277 does not affect version 6.2.8-tuxcare.5 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 6.2.8-tuxcare.6 is not affected by CVE-2026-59277. The vulnerable component (InetAddressMatchers class with matchInternal()/matchExternal() builders) does not exist in this version. The CVE affects a utility class that classifies IP addresses as internal vs external for access control purposes, but this functionality is not present in 6.2.8. The existing IpAddressMatcher class s...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.5" } ] }