{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e4ed3c88-cbc8-5639-9f0a-d4f319674bf8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-openid", "purl": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2", "version": "5.7.7-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-openid", "purl": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7", "type": "library", "group": "org.springframework.security", "version": "5.7.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-20862", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:b45c2acd-7cc6-5875-ac9e-4228f0154afd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20862 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2023-34034", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:7bf0eb24-6869-59dd-906e-94dfc31bdaa0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34034 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2023-34042", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:3ccf626a-8f1b-5574-9b8a-dd225c55ffc2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34042 does not affect version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid. not_affected \u2014 Version 5.7.7 is not affected by CVE-2023-34042. The vulnerable spring-security.xsd symlink with world-writable permissions was introduced in version 5.7.9 (commit 1eefd433b6, May 2023) and fixed in version 5.7.11 (commit 5b293d2116, September 2023). Version 5.7.7 was released before the vulnerability was introduced and contains neither the vulnerable symlink nor the build code to package it. T...", "justification": "code_not_present" } }, { "id": "CVE-2024-22257", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:98c0b600-5617-53b8-956a-0f23d4f66283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22257 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:45af9ca2-c976-5d3d-8360-dc00c11bf994", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2024-38827", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:2fb8eaf3-e88a-5454-96ab-6800d61d2d1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38827 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2025-22228", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:a59da8b7-315f-5878-af90-992841a80f34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2025-22234", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:394b6f33-d9f4-5782-a8b3-2206cbcb4031", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-22234 does not affect version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid. not_affected \u2014 Spring Security 5.7.7 is not affected by CVE-2025-22234. This CVE is a secondary vulnerability introduced by the fix for CVE-2025-22228, which added a password length check to BCrypt that broke timing attack mitigation. The target version (5.7.7) never received the CVE-2025-22228 fix, and therefore does not contain the problematic code that causes CVE-2025-22234. The timing attack mitigation in...", "justification": "code_not_present" } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:2b9be251-fa1f-5494-883a-f194ab3c56a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:dfb05656-63d6-5b4a-aa50-8cee15111c3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:55e607cb-8acb-5148-8902-650af95e5724", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2026-22748", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:870a63e1-ac15-5632-aa9f-ec29672b6e37", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22748 does not affect version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid. not_affected \u2014 Spring Security 5.7.7 is NOT AFFECTED by CVE-2026-22748. The vulnerability concerns the misleading behavior of the `withIssuerLocation()` method, which does not exist in version 5.7.7. This method was added to Spring Security in April 2023 (commit 76eba9bd0c), after the 5.7.7 release. The CVE-2026-22748 fix adds automatic issuer validation to `withIssuerLocation()` in later versions (6.x), but ...", "justification": "code_not_present" } }, { "id": "CVE-2026-22753", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:b29f8f53-8fc5-560e-9b22-35f10a76ddcf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22753 does not affect version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid. Target version 5.7.7 is not affected by CVE-2026-22753. The vulnerability affects Spring Security 7.0.0-7.0.4 and requires PathPatternRequestMatcher.Builder, a feature introduced in Spring Security 6.x (requires Spring Framework 6.x). Version 5.7.7 uses Spring Framework 5.3.25 and employs the older AntPathRequestMatcher/MvcRequestMatcher architecture with direct servlet path setters. The vulnerable code path (PathPatternRequestMatcher.Builder bean lookup in HttpSecurityConfiguration and PathPatternRequestMatcherFactoryBean.basePath() reassignment) does not exist in this version. Rule 5 Type A1 applies: the INPUT type (PathPatternRequestMatcher.Builder bean configuration) is not processed anywhere in the target codebase.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:a42e4db2-c677-5929-8c60-46c665c6a009", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid. Spring Security 5.7.7 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a fluent API bug in PathPatternRequestMatcherFactoryBean where the base path configuration is lost. Spring Security 5.7.7 uses a completely different architecture (MvcRequestMatcher, AntPathRequestMatcher, RegexRequestMatcher) without the vulnerable PathPatternRequestMatcher infrastructure. The fluent builder pattern bug does not exist in 5.7.7's implementation, which uses direct setters that correctly apply servlet path configuration.", "justification": "code_not_present" } }, { "id": "CVE-2026-40988", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:77aaa80f-68d3-563b-849a-5d3eae8246e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40988 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2026-40993", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:2b70d2de-4d31-5a02-8f00-3455229dfcc7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40993 does not affect version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid. Spring Security 5.7.7 is not affected by CVE-2026-40993. The vulnerable component JdbcAssertingPartyMetadataRepository does not exist in this version. This class was introduced in Spring Security 7.0.0, and the CVE explicitly lists affected versions as 7.0.0-7.0.5. Version 5.7.7 only provides InMemoryRelyingPartyRegistrationRepository for SAML2 configuration storage, with no JDBC-based credential repository or database deserialization functionality in the SAML2 module.", "justification": "code_not_present" } }, { "id": "CVE-2026-41003", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:daabe8fe-407d-5568-9ae1-b22a08a9204c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41003 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2026-41694", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:f1b91cc4-dc7f-5c18-9360-8a847aeeafcc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41694 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:328f5b52-595c-53d5-887b-369a743aef61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:5c4e98ad-388d-5598-b06a-648573214cec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47838 affects version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:e62037b4-379c-5562-8627-f62ccbd9e227", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2026-59270", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:577bae4c-5931-5be9-b2c7-4f163a081231", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59270 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ], "bom-ref": "urn:uuid:b6b40b5e-3b65-58aa-b679-b7970674115d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 5.7.7-tuxcare.2 of org.springframework.security:spring-security-openid." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-openid@5.7.7-tuxcare.2" } ] }