{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:41a7dbc5-c13f-521a-977f-1f4368476593", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-cas", "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1", "version": "5.1.6.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-cas", "purl": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE", "type": "library", "group": "org.springframework.security", "version": "5.1.6.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cf4a4dfd-85bf-5110-9ae7-ce83fb939762", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4007966b-ac5a-5f7f-b08c-80f3e98841a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22112 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:50b43bc2-eaa5-5021-82dd-92e7d18dd1f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:38267b7b-8925-5415-a8fc-b526e51e06f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2022-31690", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:87322f16-acdd-5890-8654-7d1020548a83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31690 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2023-34042", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c3f523e0-20df-5bfb-ab46-2107f6256733", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34042 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas. not_affected \u2014 Version 5.1.6.RELEASE is NOT AFFECTED by CVE-2023-34042. The vulnerability involves a world-writable spring-security.xsd file caused by a symlink in the source tree. However, this symlink was introduced on 2023-05-19 in versions 5.7.9 and later, and never existed in version 5.1.6.RELEASE. The problematic file spring-security.xsd does not exist in the target repository at all. All XSD files pres...", "justification": "code_not_present" } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ac7461bc-1016-5830-8afd-fd39065fe1be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3ad7ea25-d02f-557d-98e3-b9f42362e404", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:aa7675b1-2662-5dd8-bf83-7df5d425c3e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1485f621-be99-56e3-9712-77aea10480af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fb228ba5-c084-5919-b985-a538a9ed8075", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas. not_affected \u2014 The target spring-security 5.1.6.RELEASE is NOT affected by CVE-2025-22234. This CVE addresses a timing attack vulnerability that was inadvertently introduced by the CVE-2025-22228 fix. However, 5.1.6.RELEASE never received the CVE-2025-22228 backport, so the vulnerable code pattern (unconditional 72-byte password length check in BCrypt.hashpw that breaks DaoAuthenticationProvider's timing atta...", "justification": "code_not_present" } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4b92f25e-3454-556c-9d26-76d15d903211", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:29af24ab-4c89-578c-93a7-e92f240272f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1de4ec9e-22cd-5cc8-9898-fdc37733003a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-22748", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:39092476-a565-5f54-9f80-f691b3e5c5f1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22748 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas. not_affected \u2014 Spring Security 5.1.6.RELEASE is not affected by CVE-2026-22748. The vulnerability concerns the `withIssuerLocation` method in NimbusJwtDecoder and NimbusReactiveJwtDecoder, which creates confusion because it accepts an issuer parameter but does not automatically add issuer validation. This method does not exist in version 5.1.6.RELEASE - it was introduced in later versions (5.7+) in April 2023...", "justification": "code_not_present" } }, { "id": "CVE-2026-22753", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d7f15d83-4f69-55d0-96e8-ffbbf485f84d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22753 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas. Spring Security 5.1.6.RELEASE is not affected by CVE-2026-22753. The vulnerability affects versions 7.0.0-7.0.4 and involves PathPatternRequestMatcher.Builder bean discovery and basePath assignment failures. Version 5.1.6 predates the PathPatternRequestMatcher architecture entirely - it uses the older AntPathMatcher-based request matching via MvcRequestMatcher with direct servlet path setters, not the builder pattern introduced in 7.x. The vulnerable code pattern does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fdb66058-a7f5-5cc8-be93-1b3d8c18b375", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas. Spring Security 5.1.6.RELEASE is not affected by CVE-2026-22754. The vulnerability is architecture-specific to version 7.0.0-7.0.4's PathPatternRequestMatcherFactoryBean, which uses an immutable builder pattern where the basePath() return value was not captured, causing servlet-path authorization rules to be silently ignored. Version 5.1.6 uses a completely different implementation (MvcRequestMatcher) with direct property setting via setServletPath() - no builder pattern exists. The servletPath property is correctly set during bean construction (via BeanDefinitionBuilder.addPropertyValue for XML config or direct setter calls for Java config) and is properly checked at runtime in MvcRequestMatcher.matches() lines 67-70, blocking requests that don't match the configured servlet path. Tests confirm servlet-path authorization works correctly in 5.1.6. This is Rule 5 Type B: alternative defense present at runtime.", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:09624b76-6da8-5eea-91d7-de949523c7ff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41706 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas. not_affected \u2014 Spring Security 5.1.6.RELEASE is not affected by CVE-2026-41706. The vulnerable classes CookieRequestCache and CookieServerRequestCache do not exist in this version. These classes were introduced later in Spring Security 5.4.0 (July 2020), while version 5.1.6 predates this introduction. The existing request caching implementations in 5.1.6 (HttpSessionRequestCache and WebSessionServerRequestCac...", "justification": "code_not_present" } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2a2d021a-0cd1-5da2-9279-d67bff57dc75", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47838 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:066d6c01-acb8-5f10-8990-d08a312ac2d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-59270", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:948d618e-3cb3-5846-ab3d-a51440702fb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59270 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:38fbd4ee-4a52-58e7-b956-bb3699e2ec83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-cas." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-cas@5.1.6.RELEASE-tuxcare.1" } ] }