{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:aac9c1f5-5e55-5247-9b44-6eda929e358f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2", "version": "6.3.9-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:cc84549a-3be4-59fb-911f-f18a87e5cc08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:e96938f6-aabc-560e-b19e-6d5bac520392", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:e6ebb077-2ad0-5964-ade6-8e702f944da1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22747 affects version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22748", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:6e074150-e9cf-541c-a34a-fc93d8b42253", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22748 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22753", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:b02b67e9-26fa-59f5-bb49-b3ef8c530ea8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22753 does not affect version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web. Spring Security 6.3.9 is NOT AFFECTED by CVE-2026-22753. The vulnerability requires PathPatternRequestMatcher and PathPatternRequestMatcher.Builder classes introduced in Spring Security 7.0+. Version 6.3.9 uses a fundamentally different request matching architecture (MvcRequestMatcher/AntPathRequestMatcher) that predates the vulnerable infrastructure. The vulnerable pattern\u2014ignoring user-provided PathPatternRequestMatcher.Builder beans with configured base paths\u2014cannot exist because these classes and the bean-based configuration mechanism do not exist in 6.3.9. Exhaustive searches confirmed the absence of the vulnerable component.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:6b61201c-8644-5536-ab19-5aeb01c82bf7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web. Spring Security 6.3.9 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcherFactoryBean (introduced in version 7.0.x) where the builder's basePath() return value is not captured, causing servlet-path configuration to be lost. Version 6.3.9 uses a completely different architecture: MvcRequestMatcher for servlet-path handling, with no builder assignment bug. The vulnerable class PathPatternRequestMatcherFactoryBean does not exist in 6.3.9.", "justification": "code_not_present" } }, { "id": "CVE-2026-40988", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:1401d983-4135-5ba0-81a3-27a2a7ac2b09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40988 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-40993", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:cfbab94d-896c-5f67-b9a1-86137686ed90", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40993 does not affect version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web. Spring Security 6.3.9 is not affected by CVE-2026-40993. The vulnerable component `JdbcAssertingPartyMetadataRepository` does not exist in this version. This JDBC-backed SAML2 asserting party metadata storage feature, which deserializes credentials from database columns, was introduced in Spring Security 7.0.x. Version 6.3.9 only provides in-memory storage via `InMemoryRelyingPartyRegistrationRepository` with no serialization or JDBC interaction for SAML2 credentials.", "justification": "code_not_present" } }, { "id": "CVE-2026-41003", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:41db5e8b-63d9-57fc-9835-b7324cc5b205", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41003 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-41694", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:1404f61a-cc61-55ec-8f6c-b4d80a2047fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41694 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:1f20de58-c6a0-593b-a43c-2b08edecb1e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:db2491d2-70eb-5fa6-962a-d5d418e3ab6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:89076f76-4054-5f1f-bb2e-c935c4cae105", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-59270", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:9371fe54-869c-5c8b-bee5-31e9ecd35532", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59270 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:b4f82f91-c56a-5883-aa69-4f995c874484", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ] }