{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bb0ecbf4-5694-54a3-a8eb-d8e4e6e25d2c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-config", "purl": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1", "version": "5.1.5.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-config", "purl": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE", "type": "library", "group": "org.springframework.security", "version": "5.1.5.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f476be9f-c697-53f0-83f7-9bfbdc886335", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3fb84722-0622-54e0-a839-e37cd7989d2e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9d58777d-0e6a-5da7-964b-f05195bd55bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3185d9f1-7573-5c29-a00a-87925a2f0a51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2022-31690", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b6ecca12-a7b0-5a7e-a08c-97d3cb33f22f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31690 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2023-34042", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:594c85d9-9081-57cd-b742-93c657322735", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34042 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. not_affected \u2014 The target Spring Security version 5.1.5.RELEASE does not contain CVE-2023-34042's vulnerable pattern. The vulnerability concerns a symlink file (spring-security.xsd) with world-writable permissions in the JAR artifact. This symlink was introduced in Spring Security 5.7.9+ (commit 1eefd433b6, May 2023) and fixed in 5.7.11+/5.8.7+/6.0.7+/6.1.4+ (commit 5b293d2116, Sept 2023). The target version ...", "justification": "code_not_present" } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:22012225-c0ed-5298-a35f-53feca16bc29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f07b6fe8-5be5-5bb1-a2ac-66066da33e07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:64e20059-62dc-5445-8b57-e601325a6f80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d4236508-63d7-5aaa-b2b1-605242a04553", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:22065005-aa14-5257-96e6-23d3358d44eb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. not_affected \u2014 Target version 5.1.5.RELEASE is not affected by CVE-2025-22234. This CVE fixes a timing attack vulnerability introduced by CVE-2025-22228, which added an unconditional 72-byte password length check that broke timing attack mitigation in DaoAuthenticationProvider. The target does not have CVE-2025-22228 applied, therefore it cannot have the timing oracle vulnerability that CVE-2025-22234 address...", "justification": "code_not_present" } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4a10005a-628a-55f9-ad3a-f65d0ed0731f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b41a6c32-246f-529e-ab1e-ffc9d1f1a518", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b8624066-a2c2-599f-a29c-99bea3545de4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-22748", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e836ebc1-daf6-5a0e-8b70-8354f42f2c13", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22748 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. not_affected \u2014 Version 5.1.5.RELEASE is not affected by CVE-2026-22748. The vulnerability concerns the `NimbusJwtDecoder.withIssuerLocation()` and `NimbusReactiveJwtDecoder.withIssuerLocation()` methods that were introduced in later versions. This older version (from 2018) does not have these methods. The equivalent functionality that exists in 5.1.5 (`JwtDecoders.fromOidcIssuerLocation()` and `ReactiveJwtDec...", "justification": "code_not_present" } }, { "id": "CVE-2026-22753", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d6e76a75-bc6e-53ec-8396-c35a7198b927", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22753 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. Spring Security 5.1.5.RELEASE is not affected by CVE-2026-22753. The vulnerability requires PathPatternRequestMatcher.Builder, a class introduced in Spring Security 7.0+. Version 5.1.5 uses a completely different request matching architecture (MvcRequestMatcher, AntPathRequestMatcher, RegexRequestMatcher) where servlet paths are configured through direct method calls rather than bean configuration. The vulnerable code pattern cannot exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:83ae6ae7-3366-5a6d-96b4-bf89e308dd66", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. Spring Security 5.1.5.RELEASE is not affected by CVE-2026-22754. The vulnerability exists in version 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean where the basePath() return value is not captured, and HttpSecurityConfiguration doesn't use bean-provided builders. Version 5.1.5 uses a completely different architecture (MvcRequestMatcher with property setters instead of PathPatternRequestMatcher with builders), and the servlet-path feature has worked correctly since its introduction in Spring Security 4.1 (2016).", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d9eaa6ad-dec3-5d44-a059-c423343c4143", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41706 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security version 5.1.5.RELEASE is not affected by CVE-2026-41706. The vulnerable classes (CookieRequestCache and CookieServerRequestCache) that store pre-authentication redirect URLs in cookies do not exist in this version. These classes were introduced in version 5.4.0-RC1 (commit 9708a2d63f). Version 5.1.5 only has HttpSessionRequestCache (which stores requests in HTTP session, not coo...", "justification": "code_not_present" } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a77e26f9-895c-5617-8124-a5666003bbe8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47838 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d46c6ffa-720a-5b5d-bc72-026c92e7e517", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-59270", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:663bdfb1-1a70-56c7-ad75-8bde40275d43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59270 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:da81e7e5-807e-55d5-b26c-ff54cdbb29a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.1" } ] }