{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ae94f849-f20c-5875-b686-e49827a00626", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.3", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.3", "version": "6.0.7-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.7", "type": "library", "group": "org.springframework.security", "version": "6.0.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.3" } ], "bom-ref": "urn:uuid:2880de2d-6e85-58e6-9da9-6e158acb2e8f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22112 does not affect version 6.0.7-tuxcare.3 of org.springframework.security:spring-security-web. CVE-2021-22112 is NOT present in Spring Security 6.0.7. The vulnerability\u2014failure to save SecurityContext when changed multiple times in a single request\u2014was fixed in upstream commit c72a6fac04 (2021-01-22) by adding an isSaveContextInvoked flag to ensure the final SecurityContext state is persisted. This fix was already present in the upstream Spring Security 6.0.7 release that TuxCare onboarded on 2026-09-14. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.3" } ], "bom-ref": "urn:uuid:a8581c05-5f8a-5249-bc94-d1262f22cfd1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22978 does not affect version 6.0.7-tuxcare.3 of org.springframework.security:spring-security-web. CVE-2022-22978 describes an authorization bypass vulnerability in Spring Security's RegexRequestMatcher when using `.` in regex patterns. Without the Pattern.DOTALL flag, the `.` metacharacter does not match newline characters (\\n, \\r), allowing attackers to bypass regex-based authorization rules by injecting newlines into request paths (e.g., /admin%0a/sensitive bypassing /admin.* protection). The target repository (Spring Security 6.0.7-tuxcare.2) contains the fix: Pattern.DOTALL is set as the default regex flag at line 46 of RegexRequestMatcher.java. This fix was authored by upstream maintainer Rob Winch on 2022-05-12 and was already present in the Spring Security 6.0.7 release before TuxCare onboarded it on 2026-09-14. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.3" } ], "bom-ref": "urn:uuid:97465e47-df1b-5721-85d2-77553fa27ef5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 6.0.7-tuxcare.3 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.3" } ], "bom-ref": "urn:uuid:c34ebfbf-c5e4-5a13-b02d-b3a9f835d926", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.0.7-tuxcare.3 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.3" } ], "bom-ref": "urn:uuid:276e97d5-1225-5d3d-a66e-53c5e1784c48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 6.0.7-tuxcare.3 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.3" } ], "bom-ref": "urn:uuid:b1ba8ea3-ab87-5718-8ffe-5bd681fabb01", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.0.7-tuxcare.3 of org.springframework.security:spring-security-web. Version 6.0.7 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcherFactoryBean (introduced in Spring Security 7.0.0) where a builder reassignment bug causes servlet-path configurations to be ignored. Version 6.0.7 does not contain PathPatternRequestMatcher or PathPatternRequestMatcherFactoryBean. Instead, it uses MvcRequestMatcher for servlet-path support, which correctly handles the configuration without the builder bug. The CVE's affected version range (7.0.0-7.0.4) is accurate; this vulnerability was introduced with new functionality in 7.0.0 and never existed in 6.0.7.", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.3" } ], "bom-ref": "urn:uuid:fa0561b9-4a8c-5700-bc59-75108ba1ab3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.0.7-tuxcare.3 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.3" } ], "bom-ref": "urn:uuid:0f581709-bfa8-526a-9fa4-6e7446b223b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.0.7-tuxcare.3 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.3" } ], "bom-ref": "urn:uuid:b538db4a-ad54-55d5-929f-b6a72eeba7d1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 6.0.7-tuxcare.3 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 6.0.7 contains no WebAuthn code, so it is not affected.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.3" } ] }