{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7fcc9dd4-6a5a-5408-9769-00bad9a5eb8e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@5.6.7-tuxcare.7", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.7-tuxcare.7", "version": "5.6.7-tuxcare.7", "pedigree": { "ancestors": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@5.6.7", "type": "library", "group": "org.springframework.security", "version": "5.6.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.7-tuxcare.7" } ], "bom-ref": "urn:uuid:c133c1ed-8e50-500a-b971-119c2ddcd49d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22112 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-web. CVE-2021-22112 is not present in this target. The vulnerability (failure to save SecurityContext when changed multiple times in a single request) was fixed by upstream Spring Security commit 3116369f027f26e74839b840330c01ce94498bec, authored by Rob Winch, which shipped in Spring Security 5.6.7. The target is based on that upstream 5.6.7 release (onboarded via commit a7dda868db by TuxCare), so the fix was already present before any TuxCare modifications. The fix adds an isSaveContextInvoked boolean flag that tracks saveContext() invocations and includes it in the contextChanged() check, ensuring subsequent saves persist to the HTTP session even when called multiple times per request.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.7-tuxcare.7" } ], "bom-ref": "urn:uuid:ec3e9daf-5deb-50db-8c02-0762d56e298f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22978 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-web. Target version 5.6.7-tuxcare.2 is NOT affected by CVE-2022-22978. The vulnerability pattern (missing Pattern.DOTALL flag in RegexRequestMatcher) is not present in the target. The upstream vendor (Spring Security) applied the fix in commit 70863952 by Rob Winch, which was already included in the 5.6.7 release before TuxCare onboarded it. The fix adds Pattern.DOTALL to regex compilation, ensuring the '.' metacharacter matches line terminators (newlines/carriage returns), preventing authorization bypass attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.7-tuxcare.7" } ], "bom-ref": "urn:uuid:5c22bc45-0b85-561a-8836-6e8378123ad9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.7-tuxcare.7" } ], "bom-ref": "urn:uuid:b6b401ed-4e46-5f1c-b3d7-699726cca285", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22732 affects version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.7-tuxcare.7" } ], "bom-ref": "urn:uuid:fbbd63af-ab96-5f05-ae2f-ae158945da5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.7-tuxcare.7" } ], "bom-ref": "urn:uuid:acc2a224-1e9f-509a-be45-9d1c34a5bfb7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-web. CVE-2026-22754 affects Spring Security 7.0.0-7.0.4 where PathPatternRequestMatcherFactoryBean has a builder pattern bug: the result of builder.basePath() is not assigned back, causing servlet-path configuration to be lost during matcher construction, leading to authorization bypass. Target version 5.6.7 does not contain the vulnerable PathPatternRequestMatcherFactoryBean class or the PathPattern-based request matching architecture introduced in Spring Security 7.0. Version 5.6.7 uses a different architecture (MvcRequestMatcher) for servlet-path support, which correctly handles servlet path configuration through property setters rather than builder patterns. The vulnerable code pattern does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.7-tuxcare.7" } ], "bom-ref": "urn:uuid:60b967ca-d52f-5c61-aec3-9889ea064533", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.7-tuxcare.7" } ], "bom-ref": "urn:uuid:8fcd5934-30bc-54a4-9bab-4f56d20569da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.7-tuxcare.7" } ], "bom-ref": "urn:uuid:ae104d76-3eb7-50bf-bcf4-6043a3206809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 5.6.7-tuxcare.7 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 5.6.7 contains no WebAuthn code, so it is not affected.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.7-tuxcare.7" } ] }