{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f90b1794-6dc4-5634-afae-c82be1174453", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-oauth2-resource-server", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1", "version": "5.1.4.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-oauth2-resource-server", "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE", "type": "library", "group": "org.springframework.security", "version": "5.1.4.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-3795", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:940596a8-9985-5d09-a219-0fa04d37cee4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-3795 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2020-5408", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5105f009-49d0-5ed4-9138-ba14ae7865d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5408 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:88d740f7-8564-51e1-86d4-f647690ec847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2021-22119", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8cd33ff9-27c8-5cff-b449-30b3b5fa5aef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22119 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c465592a-aed1-593f-80ab-033c417cd3f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2022-31690", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e2be1eca-5e1c-5c3a-8f2b-7ff88a056ba4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-31690 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2023-34042", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a79ab56f-4b15-5a09-bd3e-0e3c90e44473", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34042 does not affect version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server. not_affected \u2014 Target version 5.1.4.RELEASE predates the introduction of the vulnerable code pattern. The world-writable symlink `spring-security.xsd` was only introduced in version 5.7.9 (commit 1eefd433b6), while the target is based on version 5.1.4.RELEASE which predates this by several major/minor versions. The file does not exist in the target repository at all.", "justification": "code_not_present" } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4b48abb8-cb2a-5ec2-92a2-d59b0a6795de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22257 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a4e47aef-0008-5bbb-8c8f-607b3c15cb9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7a618ba2-37e1-5f74-b905-5fd66b14cd73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38827 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6a725f96-97d9-5d24-85f2-d1cfe4936196", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22228 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:345a8bd1-abef-5ab8-b8c9-63f9d15a3b5b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server. not_affected \u2014 CVE-2025-22234 is a timing attack regression introduced by the CVE-2025-22228 fix. The target Spring Security 5.1.4.RELEASE (SHA e659e352de) never received the CVE-2025-22228 backport that added strict password length checking in BCrypt, therefore it does not have the timing attack vulnerability that CVE-2025-22234 addresses. The timing attack mitigation in DaoAuthenticationProvider remains int...", "justification": "code_not_present" } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4f7d0818-da9e-5d2a-b83f-f76d78e321f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22732 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1be8d984-0995-58b7-8b51-5c0861520bb8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3d964802-5e49-5727-93e8-fb1cf8ddf30e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-22748", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9c522112-650f-5334-b4ed-3fc77fb16427", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22748 does not affect version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server. not_affected \u2014 Spring Security 5.1.4.RELEASE is not affected by CVE-2026-22748. The vulnerable API pattern (NimbusJwtDecoder.withIssuerLocation and NimbusReactiveJwtDecoder.withIssuerLocation builder methods) does not exist in this version. Version 5.1.4 uses an older API design with NimbusJwtDecoderJwkSupport (constructor-based) and JwtDecoders.fromOidcIssuerLocation() static factory method, which already in...", "justification": "code_not_present" } }, { "id": "CVE-2026-22753", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:20288af3-de36-5c84-9b6d-47bc3bfb1a55", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22753 does not affect version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server. Spring Security 5.1.4.RELEASE is not affected by CVE-2026-22753. The vulnerability exists only in versions 7.0.0-7.0.4 and involves PathPatternRequestMatcher.Builder bean handling and the securityMatchers(String) API. Version 5.1.4.RELEASE predates this architecture entirely\u2014it uses AntPathRequestMatcher, MvcRequestMatcher, and RegexRequestMatcher with a requestMatchers() API (not securityMatchers). The vulnerable classes (HttpSecurityConfiguration, PathPatternRequestMatcherFactoryBean, PathPatternRequestMatcher.Builder) do not exist in this version. The servlet path handling in 5.1.4.RELEASE uses a simple setter pattern in MvcRequestMatcher, completely different from the Builder pattern vulnerability in 7.x.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a8947257-28ba-59e8-8020-e30532fc10e2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server. Spring Security 5.1.4.RELEASE is not affected by CVE-2026-22754. The vulnerability affects versions 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean where the basePath() method's return value was discarded, causing servlet-path configurations to be lost. Version 5.1.4 uses a completely different architecture: MvcRequestMatcher with direct property setters via BeanDefinitionBuilder.addPropertyValue(), which doesn't have this bug. The vulnerable classes (PathPatternRequestMatcherFactoryBean, PathPatternRequestMatcher.Builder) do not exist in 5.1.4. Tests confirm servlet-path works correctly in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:88cd03cb-4e7c-59d4-b747-82e6a5a3115b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41706 does not affect version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server. not_affected \u2014 Spring Security 5.1.4.RELEASE is not affected by CVE-2026-41706. The vulnerable classes CookieRequestCache and CookieServerRequestCache do not exist in this version - they were introduced more than a year after 5.1.4.RELEASE was released (February 2019 vs June 2020). The target version uses HttpSessionRequestCache which stores redirect URLs server-side in HttpSession, not in client-controllable...", "justification": "code_not_present" } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2d30759f-5cd9-5abd-b580-d191aecf2476", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47838 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f1f92cac-64b2-5761-9517-1aab9031548e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-59270", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a6a0cf64-9d4b-5279-b72e-01658883db79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59270 is fixed in version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7dc27edf-6355-5dbe-9984-1dd8d5fbca50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-resource-server." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-resource-server@5.1.4.RELEASE-tuxcare.1" } ] }