{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:21d5f42d-f703-582f-b286-7bf490c80207", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.7-tuxcare.4", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-web@5.7.7-tuxcare.4", "version": "5.7.7-tuxcare.4", "pedigree": { "ancestors": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.7", "type": "library", "group": "org.springframework.security", "version": "5.7.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.7.7-tuxcare.4" } ], "bom-ref": "urn:uuid:06981a06-fcb6-53f6-ba67-29f5aff65879", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22112 does not affect version 5.7.7-tuxcare.4 of org.springframework.security:spring-security-web. CVE-2021-22112 is not present in Spring Security 5.7.7. The vulnerability affected versions 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8, and 5.2.x prior to 5.2.9, where the SecurityContext would fail to save if changed more than once in a single request. The fix (commit 3116369f027 by Rob Winch, 2021-01-22) was already included in the upstream Spring Security 5.7.7 release. The vulnerable pattern\u2014a guard check preventing multiple saveContext calls\u2014is absent from the target. The current code correctly tracks all save invocations via the isSaveContextInvoked flag and ensures subsequent SecurityContext changes are persisted.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.7.7-tuxcare.4" } ], "bom-ref": "urn:uuid:3840116f-b05c-5bf7-a289-37be28e59bb6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22978 does not affect version 5.7.7-tuxcare.4 of org.springframework.security:spring-security-web. Spring Security 5.7.7 is not affected by CVE-2022-22978 (RegexRequestMatcher authorization bypass). The upstream fix that adds Pattern.DOTALL to prevent regex bypass via line terminators was already included in the 5.7.7 release before TuxCare onboarded it. The vulnerable pattern (DEFAULT = 0) is not present; the fix (DEFAULT = Pattern.DOTALL) is present at RegexRequestMatcher.java line 46.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.7.7-tuxcare.4" } ], "bom-ref": "urn:uuid:d458dfdd-8892-5427-bd20-ec196bf9fa7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 5.7.7-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.7.7-tuxcare.4" } ], "bom-ref": "urn:uuid:0050d27a-b9e1-5b1a-ac68-c63487936ef8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 5.7.7-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.7.7-tuxcare.4" } ], "bom-ref": "urn:uuid:a72dc693-daad-527c-b7bf-3e12d6f0886a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 5.7.7-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.7.7-tuxcare.4" } ], "bom-ref": "urn:uuid:622de2f1-bf5f-5837-bc4d-1f5f2b3acded", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 5.7.7-tuxcare.4 of org.springframework.security:spring-security-web. Spring Security 5.7.7 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a fluent API bug in PathPatternRequestMatcherFactoryBean where the base path configuration is lost. Spring Security 5.7.7 uses a completely different architecture (MvcRequestMatcher, AntPathRequestMatcher, RegexRequestMatcher) without the vulnerable PathPatternRequestMatcher infrastructure. The fluent builder pattern bug does not exist in 5.7.7's implementation, which uses direct setters that correctly apply servlet path configuration.", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.7.7-tuxcare.4" } ], "bom-ref": "urn:uuid:0ab860c0-30da-5699-a9c7-243c14d729b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 5.7.7-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.7.7-tuxcare.4" } ], "bom-ref": "urn:uuid:d1e5ddca-7460-5b2b-b1ee-198cb5086ca1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47838 affects version 5.7.7-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.7.7-tuxcare.4" } ], "bom-ref": "urn:uuid:d959acd8-042a-58a2-bbe4-4a145c514190", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 5.7.7-tuxcare.4 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 5.7.7 contains no WebAuthn code, so it is not affected.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.7.7-tuxcare.4" } ] }