{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fb421d0e-e32d-5162-8111-d44269efcc1a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.2", "version": "5.1.5.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE", "type": "library", "group": "org.springframework.security", "version": "5.1.5.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:27aa18b8-3490-5577-85a4-d723b480eec2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22112 is fixed in version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a386991c-41d3-533f-87dd-51296be0b957", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c16ea20a-5f30-51cb-82fb-376b66962e93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e3de6474-a6a9-55d4-88e3-8ae58dedf05a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2372c9f9-afbb-5711-a9d1-5f1fd3d1846d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ba3eda7f-75bb-5ca9-ac86-ac43566530cf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web. Spring Security 5.1.5.RELEASE is not affected by CVE-2026-22754. The vulnerability exists in version 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean where the basePath() return value is not captured, and HttpSecurityConfiguration doesn't use bean-provided builders. Version 5.1.5 uses a completely different architecture (MvcRequestMatcher with property setters instead of PathPatternRequestMatcher with builders), and the servlet-path feature has worked correctly since its introduction in Spring Security 4.1 (2016).", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:23a358cc-8886-5cd1-a7ca-1189dbe328d5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41706 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security version 5.1.5.RELEASE is not affected by CVE-2026-41706. The vulnerable classes (CookieRequestCache and CookieServerRequestCache) that store pre-authentication redirect URLs in cookies do not exist in this version. These classes were introduced in version 5.4.0-RC1 (commit 9708a2d63f). Version 5.1.5 only has HttpSessionRequestCache (which stores requests in HTTP session, not coo...", "justification": "code_not_present" } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c3098549-c078-5a6e-87f0-801ff8cd5c1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b50da7f9-638f-503a-a35c-5a373ed13c6e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 5.1.5.RELEASE contains no WebAuthn code, so it is not affected.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.2" } ] }