{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6c9d15ee-60e0-5fa7-b426-018f1c6d6582", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@5.6.5-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.5-tuxcare.2", "version": "5.6.5-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@5.6.5", "type": "library", "group": "org.springframework.security", "version": "5.6.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.5-tuxcare.2" } ], "bom-ref": "urn:uuid:93b635a7-5425-59ca-967b-8feaecf168c7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22112 does not affect version 5.6.5-tuxcare.2 of org.springframework.security:spring-security-web. CVE-2021-22112 affects Spring Security versions prior to 5.4.4, 5.3.8, and 5.2.9, where the SecurityContext fails to persist when changed multiple times in a single request. The target version 5.6.5 already contains the upstream fix (commit 3116369f02) that was shipped in the upstream release. The fix introduces the isSaveContextInvoked flag and modifies the contextChanged() method to properly track and persist multiple SecurityContext changes. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.5-tuxcare.2" } ], "bom-ref": "urn:uuid:8f21610d-c63c-5048-8498-e40829362bdd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22978 does not affect version 5.6.5-tuxcare.2 of org.springframework.security:spring-security-web. CVE-2022-22978 fix (Pattern.DOTALL in RegexRequestMatcher) was already present in the upstream Spring Security 5.6.5 release that TuxCare onboarded. The vulnerable pattern where `.` in regex fails to match line terminators (\\n, \\r) does not exist in the target. Commit 70863952ae by upstream author rwinch@users.noreply.github.com added the fix before the TuxCare onboarding commit 03dfa51e64.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.5-tuxcare.2" } ], "bom-ref": "urn:uuid:6fcefa05-b37a-53d4-80e7-1b0f59f707a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 5.6.5-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.5-tuxcare.2" } ], "bom-ref": "urn:uuid:fa856e6d-080b-5d45-b2be-65dc1062c969", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22732 affects version 5.6.5-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.5-tuxcare.2" } ], "bom-ref": "urn:uuid:2d48a3b6-795a-576a-93b9-9aafa390be86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22747 affects version 5.6.5-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.5-tuxcare.2" } ], "bom-ref": "urn:uuid:7605cac0-0f28-5ff6-b092-efd56d0cd97a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 5.6.5-tuxcare.2 of org.springframework.security:spring-security-web. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.6.5 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4vrc-j85c-598c (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.5-tuxcare.2" } ], "bom-ref": "urn:uuid:1f09a0a9-9cdd-582f-96dd-7a4b4c2a4c1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 5.6.5-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.5-tuxcare.2" } ], "bom-ref": "urn:uuid:0eac4a17-9115-547b-9eb8-77428aca6973", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 5.6.5-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.5-tuxcare.2" } ], "bom-ref": "urn:uuid:af59b700-5fd4-5ae7-86dc-1c7c58918529", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 5.6.5-tuxcare.2 of org.springframework.security:spring-security-web. Prechecker: No vulnerable code from the fix was found; the vulnerable lines are absent, this version declares none of the classes the fix changes, and their base package is absent. Version 5.6.5 is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only).", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.5-tuxcare.2" } ] }