{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a4da247e-e2f9-5745-8037-08490c00c215", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1", "version": "5.1.5.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE", "type": "library", "group": "org.springframework.security", "version": "5.1.5.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:33af131c-b790-5f6d-b59b-6733fb576e68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22112 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web, and is fixed in 5.1.5.RELEASE-tuxcare.2." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7996524e-35c7-542e-937c-7cde574c5529", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:628e8c90-7124-5479-8abb-1e8fd38f2675", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:07d35b98-11cb-5d26-bac5-5627a2382b1e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4611f914-041f-56af-9b46-b586deadbe2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ef7e3fee-50d9-550d-be0a-9ee9ebb265c9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. Spring Security 5.1.5.RELEASE is not affected by CVE-2026-22754. The vulnerability exists in version 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean where the basePath() return value is not captured, and HttpSecurityConfiguration doesn't use bean-provided builders. Version 5.1.5 uses a completely different architecture (MvcRequestMatcher with property setters instead of PathPatternRequestMatcher with builders), and the servlet-path feature has worked correctly since its introduction in Spring Security 4.1 (2016).", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c148e7d1-7d48-515d-844f-1c4f160707a7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41706 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security version 5.1.5.RELEASE is not affected by CVE-2026-41706. The vulnerable classes (CookieRequestCache and CookieServerRequestCache) that store pre-authentication redirect URLs in cookies do not exist in this version. These classes were introduced in version 5.4.0-RC1 (commit 9708a2d63f). Version 5.1.5 only has HttpSessionRequestCache (which stores requests in HTTP session, not coo...", "justification": "code_not_present" } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:33e6f324-9272-5a62-abcc-ccfc502776e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47838 affects version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web, and is fixed in 5.1.5.RELEASE-tuxcare.2." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:03f4449b-9522-5605-9dcc-d5ed39ac94d8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 5.1.5.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 5.1.5.RELEASE contains no WebAuthn code, so it is not affected.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.5.RELEASE-tuxcare.1" } ] }