{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:12c21236-5ccf-57cf-900d-61432b005d9a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-config", "purl": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.2", "version": "6.3.9-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:07590647-841e-52fb-99e1-2956a824b652", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:c559a547-59c9-59b6-8f8c-98b293689c10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:9b86b547-0358-5f87-83db-a27448a29230", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22747 affects version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-22748", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:a52934c7-8bd1-597b-84f7-4520eb3ae3d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22748 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-22753", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:65e04c3f-b38a-5e65-8ebf-4945fb987141", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22753 does not affect version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-config. Spring Security 6.3.9 is NOT AFFECTED by CVE-2026-22753. The vulnerability requires PathPatternRequestMatcher and PathPatternRequestMatcher.Builder classes introduced in Spring Security 7.0+. Version 6.3.9 uses a fundamentally different request matching architecture (MvcRequestMatcher/AntPathRequestMatcher) that predates the vulnerable infrastructure. The vulnerable pattern\u2014ignoring user-provided PathPatternRequestMatcher.Builder beans with configured base paths\u2014cannot exist because these classes and the bean-based configuration mechanism do not exist in 6.3.9. Exhaustive searches confirmed the absence of the vulnerable component.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:c033348e-759b-530c-928e-169c042875a1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-config. Spring Security 6.3.9 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcherFactoryBean (introduced in version 7.0.x) where the builder's basePath() return value is not captured, causing servlet-path configuration to be lost. Version 6.3.9 uses a completely different architecture: MvcRequestMatcher for servlet-path handling, with no builder assignment bug. The vulnerable class PathPatternRequestMatcherFactoryBean does not exist in 6.3.9.", "justification": "code_not_present" } }, { "id": "CVE-2026-40988", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:1cd7243c-f0ac-5585-aab9-2ce04f12aff7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40988 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-40993", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:ad18968f-9234-54ff-b90a-0d0746ececec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40993 does not affect version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-config. Spring Security 6.3.9 is not affected by CVE-2026-40993. The vulnerable component `JdbcAssertingPartyMetadataRepository` does not exist in this version. This JDBC-backed SAML2 asserting party metadata storage feature, which deserializes credentials from database columns, was introduced in Spring Security 7.0.x. Version 6.3.9 only provides in-memory storage via `InMemoryRelyingPartyRegistrationRepository` with no serialization or JDBC interaction for SAML2 credentials.", "justification": "code_not_present" } }, { "id": "CVE-2026-41003", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:72b1f718-a1f9-5b10-bbe1-9e9d900ee1ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41003 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-41694", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:6ad1f71d-da5e-50c7-8b44-a5410db4661e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41694 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:94e4e554-1041-5e69-a72d-9a004500a9ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:e0b8a407-c981-53d5-a0f9-5bcbf295554f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:c14cd406-ca0a-5b91-8407-2dd347180199", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-59270", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:d8f28a81-20fb-52f3-b882-0957495256c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59270 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-config." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:a2750a2a-fc12-5e1f-896e-1a51898810bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-config." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.2" } ] }