{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6fdcf94d-40ad-5f86-ae50-f801ac34dd15", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.3", "type": "library", "group": "org.springframework.security", "name": "spring-security-saml2-service-provider", "version": "6.2.8-tuxcare.3", "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.3" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:223f36f4-6111-58fb-99ee-e7acc69d8dcd", "id": "CVE-2025-22228", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.2.8-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ad2916bb-70d3-5c6b-8847-108d579bcb83", "id": "CVE-2025-22234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22234 affects version 6.2.8-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:1877b258-ce90-5a97-89f4-07566817d142", "id": "CVE-2026-22732", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.2.8-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:ba841ace-19a2-556b-abe0-564d77415c90", "id": "CVE-2026-22746", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.2.8-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:f79f87a6-2db9-5353-94c5-d8ee6211e97a", "id": "CVE-2026-22747", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22747 affects version 6.2.8-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:c6fbbd11-125c-5660-947c-0636fb1da228", "id": "CVE-2026-22748", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22748 is fixed in version 6.2.8-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0f6508bd-855c-5af7-9d04-c48403762d34", "id": "CVE-2026-22753", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22753 does not affect version 6.2.8-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider. not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2026-22753. The vulnerability is specific to PathPatternRequestMatcher.Builder functionality introduced in Spring Security 7.0.0. Version 6.2.8 uses a different request matching architecture (MvcRequestMatcher and AntPathRequestMatcher) that does not contain the vulnerable code pattern." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:a3856063-8895-5588-88c7-8840d510395c", "id": "CVE-2026-22754", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.2.8-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider. not_affected \u2014 Version 6.2.8 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean, a class that does not exist in version 6.2.8. Version 6.2.8 uses a completely different architecture (MvcRequestMatcher with property setters) that correctly handles servlet-path configuration without the builder reassignm..." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:830c4f42-7e1e-552b-bbba-16ee475cbd1e", "id": "CVE-2026-40988", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40988 is fixed in version 6.2.8-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:bd38fd18-baec-5e1a-ae6c-42123ab8b9ab", "id": "CVE-2026-40993", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40993 does not affect version 6.2.8-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider. Spring Security 6.2.8 is not affected by CVE-2026-40993. The vulnerable component JdbcAssertingPartyMetadataRepository does not exist in this version. The CVE specifically affects Spring Security 7.0.0 - 7.0.5, where the JDBC-based SAML2 asserting party metadata repository was introduced. Version 6.2.8 only contains in-memory and HTTP session-based SAML2 repositories, with no JDBC-based implementation for asserting party metadata storage. The vulnerability pattern (unsafe deserialization of credentials from database columns) cannot manifest because the affected code path does not exist in this version." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5dcac89d-4411-57a4-9347-a008497821f0", "id": "CVE-2026-41003", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41003 is fixed in version 6.2.8-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:8afa8266-f954-5cba-879e-200471082575", "id": "CVE-2026-41694", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41694 is fixed in version 6.2.8-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:0e7dbd7a-e0ca-5041-b562-b40a281a35d4", "id": "CVE-2026-41706", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.2.8-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.3" } ] }, { "bom-ref": "urn:uuid:5b791050-2b1b-583a-9a3a-02d7ad744210", "id": "CVE-2026-47838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.2.8-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider." }, "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.3" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.3" } ] }