{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:604016a8-2165-5246-9d8a-27fda20641ac", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.6.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.6.RELEASE-tuxcare.3", "version": "5.1.6.RELEASE-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.6.RELEASE", "type": "library", "group": "org.springframework.security", "version": "5.1.6.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.6.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:5733edec-4585-5630-b03a-ebcaf10b9dc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22112 is fixed in version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.6.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:0b420415-e74c-53b4-b782-74246ff8a4f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22978 is fixed in version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.6.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:43de6eed-bb00-56e7-9806-c298e2d6c8bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.6.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:a3ecf297-430d-5743-ade4-9d7b23be2ce5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.6.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:18303d66-bc12-50f0-a524-6351d1cac61f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.6.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:3f32740f-e3e5-5431-9e1e-fb87445b8e2d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-web. Spring Security 5.1.6.RELEASE is not affected by CVE-2026-22754. The vulnerability is architecture-specific to version 7.0.0-7.0.4's PathPatternRequestMatcherFactoryBean, which uses an immutable builder pattern where the basePath() return value was not captured, causing servlet-path authorization rules to be silently ignored. Version 5.1.6 uses a completely different implementation (MvcRequestMatcher) with direct property setting via setServletPath() - no builder pattern exists. The servletPath property is correctly set during bean construction (via BeanDefinitionBuilder.addPropertyValue for XML config or direct setter calls for Java config) and is properly checked at runtime in MvcRequestMatcher.matches() lines 67-70, blocking requests that don't match the configured servlet path. Tests confirm servlet-path authorization works correctly in 5.1.6. This is Rule 5 Type B: alternative defense present at runtime.", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.6.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:038b89e7-3d0b-5a15-999d-7d4baaa8e5ea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41706 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 5.1.6.RELEASE is not affected by CVE-2026-41706. The vulnerable classes CookieRequestCache and CookieServerRequestCache do not exist in this version. These classes were introduced later in Spring Security 5.4.0 (July 2020), while version 5.1.6 predates this introduction. The existing request caching implementations in 5.1.6 (HttpSessionRequestCache and WebSessionServerRequestCac...", "justification": "code_not_present" } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.6.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:88f0aedb-6d8c-52de-b7a8-ab4154127234", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.6.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:d3c9bacf-14b4-561b-a1f9-6359b2257376", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 5.1.6.RELEASE contains no WebAuthn code, so it is not affected.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.1.6.RELEASE-tuxcare.3" } ] }