{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0639f6aa-a6ee-5a12-bfa6-7ee54cbe1d8e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.2", "version": "3.2.8.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE", "type": "library", "group": "org.springframework.security", "version": "3.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5501f4ad-ca90-56f7-a03c-387c85df2326", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22112 is fixed in version 3.2.8.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:45df0d70-59f9-5433-8b70-647a8ec24726", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 3.2.8.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3bfc76ba-ccdf-5be8-a179-13f7cadadcf8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38821 affects version 3.2.8.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:89765586-a9ef-5723-af98-c4c9940e097e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 3.2.8.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6ecfcbf4-05e1-515f-ad9c-d179e7d22b50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 3.2.8.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:81cab85d-8f95-5df4-aaae-048d6d10e4cb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 3.2.8.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web. Spring Security 3.2.8.RELEASE is not affected by CVE-2026-22754. The vulnerability exists in the servlet-path attribute feature for intercept-url elements, which was introduced in Spring Security 7.0.0. Version 3.2.8 uses a completely different architecture (AntPathRequestMatcher/RegexRequestMatcher) that reads servlet paths from HTTP requests rather than configuration. The servlet-path attribute does not exist in the 3.2.8 XSD schema, and the vulnerable classes (PathPatternRequestMatcherFactoryBean, HttpSecurityConfiguration with PathPatternRequestMatcher.Builder) do not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:06ebf3be-81df-54c4-889d-7be017c1482f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41706 does not affect version 3.2.8.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security version 3.2.8.RELEASE is not affected by CVE-2026-41706. The vulnerable classes CookieRequestCache and CookieServerRequestCache do not exist in this version. Version 3.2.8 only implements session-based request caching via HttpSessionRequestCache, which stores saved requests in HTTP sessions, not cookies. The vulnerability specifically requires applications to use CookieRequestCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d943138a-6f24-5f78-9f68-8c59539a5e6c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 3.2.8.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:70fffb14-d5d1-5ccd-84fb-5a1eb214878f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 3.2.8.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 3.2.8.RELEASE contains no WebAuthn code, so it is not affected.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@3.2.8.RELEASE-tuxcare.2" } ] }