{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7346a065-85cf-5926-b51c-fbec864a5c4b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.4", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.4", "version": "6.0.7-tuxcare.4", "pedigree": { "ancestors": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.7", "type": "library", "group": "org.springframework.security", "version": "6.0.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.4" } ], "bom-ref": "urn:uuid:36e9cc41-cd77-5194-99f9-60a6e45b225d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22112 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-web. CVE-2021-22112 is NOT present in Spring Security 6.0.7. The vulnerability\u2014failure to save SecurityContext when changed multiple times in a single request\u2014was fixed in upstream commit c72a6fac04 (2021-01-22) by adding an isSaveContextInvoked flag to ensure the final SecurityContext state is persisted. This fix was already present in the upstream Spring Security 6.0.7 release that TuxCare onboarded on 2026-09-14. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.4" } ], "bom-ref": "urn:uuid:33c4252a-4139-5566-a771-9a9ffafd45a7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22978 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-web. CVE-2022-22978 describes an authorization bypass vulnerability in Spring Security's RegexRequestMatcher when using `.` in regex patterns. Without the Pattern.DOTALL flag, the `.` metacharacter does not match newline characters (\\n, \\r), allowing attackers to bypass regex-based authorization rules by injecting newlines into request paths (e.g., /admin%0a/sensitive bypassing /admin.* protection). The target repository (Spring Security 6.0.7-tuxcare.2) contains the fix: Pattern.DOTALL is set as the default regex flag at line 46 of RegexRequestMatcher.java. This fix was authored by upstream maintainer Rob Winch on 2022-05-12 and was already present in the Spring Security 6.0.7 release before TuxCare onboarded it on 2026-09-14. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.4" } ], "bom-ref": "urn:uuid:83f57d5a-e951-5e1d-b863-0974ddbead56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.4" } ], "bom-ref": "urn:uuid:36fad0d8-12a9-55b3-865d-b72d964df128", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.4" } ], "bom-ref": "urn:uuid:23538469-07fc-5978-ba2b-23c0d6396437", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.4" } ], "bom-ref": "urn:uuid:8ef340a4-0060-5577-8c62-b72c0e7cd9ba", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-web. Version 6.0.7 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcherFactoryBean (introduced in Spring Security 7.0.0) where a builder reassignment bug causes servlet-path configurations to be ignored. Version 6.0.7 does not contain PathPatternRequestMatcher or PathPatternRequestMatcherFactoryBean. Instead, it uses MvcRequestMatcher for servlet-path support, which correctly handles the configuration without the builder bug. The CVE's affected version range (7.0.0-7.0.4) is accurate; this vulnerability was introduced with new functionality in 7.0.0 and never existed in 6.0.7.", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.4" } ], "bom-ref": "urn:uuid:7fe7baed-50df-5717-8fbf-805b4363eb86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.4" } ], "bom-ref": "urn:uuid:d76c99bf-a992-5101-9677-faeafec392f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.4" } ], "bom-ref": "urn:uuid:5d4168cc-49c5-53fd-881e-e8e9d0459a90", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 6.0.7 contains no WebAuthn code, so it is not affected.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.4" } ] }