{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:934343dc-ee83-5a95-9e69-daba7a85a867", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@5.6.9-tuxcare.5", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.9-tuxcare.5", "version": "5.6.9-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@5.6.9", "type": "library", "group": "org.springframework.security", "version": "5.6.9" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.9-tuxcare.5" } ], "bom-ref": "urn:uuid:104852e5-370f-5fc5-85e0-c8e6c39ad819", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22112 does not affect version 5.6.9-tuxcare.5 of org.springframework.security:spring-security-web. CVE-2021-22112 affects Spring Security versions prior to 5.4.4, 5.3.8.RELEASE, and 5.2.9.RELEASE. The vulnerability allows SecurityContext changes made multiple times in a single request to fail to save the final state, potentially extending elevated privileges beyond their intended scope. The target version 5.6.9 already contains the upstream fix (commit c72a6fac04) which was integrated into Spring Security 5.4.4 and later releases in January 2021. The fix adds a boolean flag `isSaveContextInvoked` to track multiple saveContext invocations and ensures the final SecurityContext is persisted correctly. This is an upstream fix that shipped in the 5.6.9 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.9-tuxcare.5" } ], "bom-ref": "urn:uuid:67d7fcf1-53ea-5c8b-ae39-0a95aac65c12", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22978 does not affect version 5.6.9-tuxcare.5 of org.springframework.security:spring-security-web. CVE-2022-22978 affects RegexRequestMatcher in Spring Security versions 5.5.6, 5.5.7, and older, where missing Pattern.DOTALL flag allows authorization bypass via paths containing newline/carriage return characters. The vulnerability pattern is NOT present in target version 5.6.9. The fix (adding Pattern.DOTALL flag) was authored by Rob Winch (upstream) in commit 70863952ae and shipped in the upstream Spring Security 5.6.9 release before TuxCare onboarded it. No TuxCare backport exists for 5.6.9 (backports only exist for older versions 3.2.8, 4.2.x, 5.1.x). Verdict: not_affected (upstream fix already in release).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.9-tuxcare.5" } ], "bom-ref": "urn:uuid:c9e43c4d-b0f7-5dc7-8565-98f2eb242d48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38821 is fixed in version 5.6.9-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.9-tuxcare.5" } ], "bom-ref": "urn:uuid:f4e4c979-a133-586a-acc3-684846afbbe7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 5.6.9-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.9-tuxcare.5" } ], "bom-ref": "urn:uuid:5d66b719-2c5b-525a-b59a-992661f15540", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 5.6.9-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.9-tuxcare.5" } ], "bom-ref": "urn:uuid:4f2e1042-491f-5877-a986-43be9a769ce6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 5.6.9-tuxcare.5 of org.springframework.security:spring-security-web. CVE-2026-22754 affects Spring Security 7.0.0-7.0.4, which introduced PathPatternRequestMatcherFactoryBean with a builder pattern bug where basePath() return value is discarded. Target version 5.6.9 uses a completely different architecture (MvcRequestMatcher with property setters) that correctly enforces servlet-path authorization rules. The vulnerable code path does not exist in this version.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.9-tuxcare.5" } ], "bom-ref": "urn:uuid:dd95a2e3-640d-525e-9e38-ffeae6d9b000", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 5.6.9-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.9-tuxcare.5" } ], "bom-ref": "urn:uuid:09e4c93e-1fc9-5a6a-abaa-a91467a9ba25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 5.6.9-tuxcare.5 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.9-tuxcare.5" } ], "bom-ref": "urn:uuid:e6b22b00-139a-53b6-b28b-e8f1f1603bbf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 5.6.9-tuxcare.5 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 5.6.9 contains no WebAuthn code, so it is not affected.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@5.6.9-tuxcare.5" } ] }