{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dd38fc65-45f4-5ee1-88e1-d8ce76577f21", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1", "version": "3.2.8.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE", "type": "library", "group": "org.springframework.security", "version": "3.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d4e26d28-9da1-5e35-aeba-877ffedf59c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22112 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:480cef70-8a9e-5715-848c-8db4050dee5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fcf1ec7b-9353-5eaf-9f6c-3640b532fea5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38821 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c46a4c3b-9f7f-5304-a0ab-d63e3525d5bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fbe802e4-65d0-59f4-a3f3-0f3419d86766", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4379fdc6-161b-5b30-bba4-b47b96893bd9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. Spring Security 3.2.8.RELEASE is not affected by CVE-2026-22754. The vulnerability exists in the servlet-path attribute feature for intercept-url elements, which was introduced in Spring Security 7.0.0. Version 3.2.8 uses a completely different architecture (AntPathRequestMatcher/RegexRequestMatcher) that reads servlet paths from HTTP requests rather than configuration. The servlet-path attribute does not exist in the 3.2.8 XSD schema, and the vulnerable classes (PathPatternRequestMatcherFactoryBean, HttpSecurityConfiguration with PathPatternRequestMatcher.Builder) do not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:74acc4e0-975a-598f-bd63-43affe70ff94", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41706 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security version 3.2.8.RELEASE is not affected by CVE-2026-41706. The vulnerable classes CookieRequestCache and CookieServerRequestCache do not exist in this version. Version 3.2.8 only implements session-based request caching via HttpSessionRequestCache, which stores saved requests in HTTP sessions, not cookies. The vulnerability specifically requires applications to use CookieRequestCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:63dd4b6e-c17b-5bb2-852f-2145a9e0887e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47838 affects version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web, and is fixed in 3.2.8.RELEASE-tuxcare.2." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f2122e1c-2010-58f7-b479-464a2ec3e7f4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 3.2.8.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 3.2.8.RELEASE contains no WebAuthn code, so it is not affected.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.1" } ] }