{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2cc55807-700e-501e-afce-61f6841348b7", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework.security/spring-security-bom@6.2.7-tuxcare.2", "type": "library", "group": "org.springframework.security", "name": "spring-security-bom", "version": "6.2.7-tuxcare.2", "purl": "pkg:maven/org.springframework.security/spring-security-bom@6.2.7-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:9f98b046-5f8f-59ee-8803-5aad2432757f", "id": "CVE-2024-38827", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-bom@6.2.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4ab9f439-1b0c-5eca-a509-a3adae11b4f6", "id": "CVE-2025-22228", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-bom@6.2.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:52899c37-1d70-5b3f-9625-4e60538683d9", "id": "CVE-2025-22234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-bom@6.2.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ad14c49a-8952-5ef3-9c6c-9dfa7d2f75da", "id": "CVE-2026-22732", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-bom@6.2.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0b36f0f3-2262-5bb6-9623-1e593992088f", "id": "CVE-2026-22746", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-bom@6.2.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:62bf5737-eeb9-5e72-9a4c-845014f5f094", "id": "CVE-2026-22747", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22747 affects version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-bom@6.2.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:61a6dd3f-6791-560c-af5b-019b83659d36", "id": "CVE-2026-22748", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22748 affects version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-bom@6.2.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:e9d19ef2-3887-5812-bcb8-1fa7b97eae6f", "id": "CVE-2026-22753", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22753 does not affect version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-bom. not_affected \u2014 Spring Security 6.2.7 is not affected by CVE-2026-22753. The vulnerability concerns PathPatternRequestMatcher.Builder bean handling, a feature introduced in version 7.0.0. Version 6.2.7 uses a completely different request matching architecture based on MvcRequestMatcher and AntPathRequestMatcher, with servlet path handling implemented via MvcRequestMatcher.setServletPath(). The vulnerable code ..." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-bom@6.2.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:854beaa3-de40-5715-8f2d-b56c46e329fe", "id": "CVE-2026-22754", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-bom. not_affected \u2014 Spring Security 6.2.7 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean (introduced in 7.x) where basePath assignment was missing. Version 6.2.7 uses a different architecture (MvcRequestMatcher for servlet-path handling) that does not have this vulnerability pattern." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-bom@6.2.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:75be4b24-8cd4-5bca-a853-7d21d56e1095", "id": "CVE-2026-40988", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-40988 affects version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-bom@6.2.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:6cc8039e-6fe4-5a73-8802-0487a17632b3", "id": "CVE-2026-40993", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40993 does not affect version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-bom. Spring Security 6.2.7 is NOT AFFECTED by CVE-2026-40993. The vulnerable class `JdbcAssertingPartyMetadataRepository` and the entire asserting party metadata repository feature do not exist in this version. The feature was introduced in Spring Security 6.4.0 (July 2024), which is newer than the target version 6.2.7. The CVE affects versions 7.0.0 - 7.0.5. The SAML2 module in 6.2.7 has no JDBC-based repositories and no code that deserializes credentials from database columns." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-bom@6.2.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d939ec00-efdd-5cba-972b-a56c21e5130b", "id": "CVE-2026-41003", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41003 affects version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-bom@6.2.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:0a1db2d0-2317-59f2-8891-7ed9a4fbf7eb", "id": "CVE-2026-41694", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41694 affects version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-bom@6.2.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:cc2d8e97-f681-5509-86e2-80d7c4069d3d", "id": "CVE-2026-41706", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41706 affects version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-bom@6.2.7-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2f1622c0-63e4-5b3e-b985-1fb31a7943b5", "id": "CVE-2026-47838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-bom." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-bom@6.2.7-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-bom@6.2.7-tuxcare.2" } ] }