{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3d3fe924-49d8-5c72-9ecc-e8e56431fb23", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-aspects", "purl": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.9-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.9-tuxcare.2", "version": "6.3.9-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:d954d073-9034-5063-b6c1-dd9893858315", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:f6408198-0b47-55f7-bae6-ba7022033616", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:a2cfcf2e-bfd0-56b9-848d-52f7bda1e3ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22747 affects version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-22748", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:abf8eb7c-6431-5abd-b9b2-e4fe02739e2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22748 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-22753", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:53c46470-f0ab-52c5-8985-980ba5191b22", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22753 does not affect version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-aspects. Spring Security 6.3.9 is NOT AFFECTED by CVE-2026-22753. The vulnerability requires PathPatternRequestMatcher and PathPatternRequestMatcher.Builder classes introduced in Spring Security 7.0+. Version 6.3.9 uses a fundamentally different request matching architecture (MvcRequestMatcher/AntPathRequestMatcher) that predates the vulnerable infrastructure. The vulnerable pattern\u2014ignoring user-provided PathPatternRequestMatcher.Builder beans with configured base paths\u2014cannot exist because these classes and the bean-based configuration mechanism do not exist in 6.3.9. Exhaustive searches confirmed the absence of the vulnerable component.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:d6a57ed2-4d60-5053-823d-080c90501160", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-aspects. Spring Security 6.3.9 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcherFactoryBean (introduced in version 7.0.x) where the builder's basePath() return value is not captured, causing servlet-path configuration to be lost. Version 6.3.9 uses a completely different architecture: MvcRequestMatcher for servlet-path handling, with no builder assignment bug. The vulnerable class PathPatternRequestMatcherFactoryBean does not exist in 6.3.9.", "justification": "code_not_present" } }, { "id": "CVE-2026-40988", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:8b313216-a985-5e77-8048-a9c13550e4e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40988 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-40993", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:df40e26a-0751-52e9-8878-5e33f4849630", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40993 does not affect version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-aspects. Spring Security 6.3.9 is not affected by CVE-2026-40993. The vulnerable component `JdbcAssertingPartyMetadataRepository` does not exist in this version. This JDBC-backed SAML2 asserting party metadata storage feature, which deserializes credentials from database columns, was introduced in Spring Security 7.0.x. Version 6.3.9 only provides in-memory storage via `InMemoryRelyingPartyRegistrationRepository` with no serialization or JDBC interaction for SAML2 credentials.", "justification": "code_not_present" } }, { "id": "CVE-2026-41003", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:50f9e430-785e-54fa-953a-872d851956b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41003 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-41694", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:592c88ec-af71-5a48-90c3-29997eb3d31b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41694 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:0235e774-f4e4-5ce1-ad7b-39991b19861f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:04cb0bcc-8004-5fdd-a8a3-24841c236a20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:8ced3bc4-497e-55fe-afad-b6fac6c3636f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-59270", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:d936c18c-1562-5d86-96a8-d46fec51036a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59270 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-aspects." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:3e680a8e-fefb-5e07-a370-f3f1d64e75c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-aspects." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-aspects@6.3.9-tuxcare.2" } ] }