{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3b2b32f4-06cb-5b00-8e99-f797d6762baa", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@6.1.5-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-web@6.1.5-tuxcare.2", "version": "6.1.5-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@6.1.5", "type": "library", "group": "org.springframework.security", "version": "6.1.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.1.5-tuxcare.2" } ], "bom-ref": "urn:uuid:9b39b5b0-5146-5f3b-8fe4-1bcbd5353b9d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22112 does not affect version 6.1.5-tuxcare.2 of org.springframework.security:spring-security-web. The target Spring Security 6.1.5-tuxcare.2 is not affected by CVE-2021-22112. The upstream fix commits (c72a6fac, 7cab7b06) for issue gh-9387 were already included in Spring Security 6.1.5 before TuxCare onboarded this version. The vulnerable code pattern (early-return guard preventing multiple SecurityContext saves per request) has been replaced with proper tracking via the isSaveContextInvoked field. The fix ensures that when SecurityContext is changed multiple times in a single request (e.g., elevating privileges temporarily then reverting), the final context state is correctly persisted to the session.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.1.5-tuxcare.2" } ], "bom-ref": "urn:uuid:9e52aaf6-d790-506f-b4b6-2ed914866576", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22978 does not affect version 6.1.5-tuxcare.2 of org.springframework.security:spring-security-web. Spring Security 6.1.5 is NOT affected by CVE-2022-22978. The vulnerability involved RegexRequestMatcher being bypassable via HTTP request paths containing line terminators (\\n or \\r) because the `.` metacharacter in regex patterns did not match these characters without the Pattern.DOTALL flag. The fix (adding Pattern.DOTALL to all regex compilation in RegexRequestMatcher) was already present in the upstream Spring Security 6.1.5 release that TuxCare onboarded. The vulnerable pattern is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.1.5-tuxcare.2" } ], "bom-ref": "urn:uuid:c5f90c23-b85d-59d8-8524-f57a987ff56c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38821 affects version 6.1.5-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.1.5-tuxcare.2" } ], "bom-ref": "urn:uuid:de6a7fec-4565-5b7c-8491-45ea8a85520a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22732 affects version 6.1.5-tuxcare.2 of org.springframework.security:spring-security-web, and is fixed in 6.1.5-tuxcare.3." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.1.5-tuxcare.2" } ], "bom-ref": "urn:uuid:f68876cc-2328-5dff-be93-e2d6b1d07c5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22747 affects version 6.1.5-tuxcare.2 of org.springframework.security:spring-security-web, and is fixed in 6.1.5-tuxcare.3." } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.1.5-tuxcare.2" } ], "bom-ref": "urn:uuid:6acabd1e-a05f-50ca-840c-84ef64e25af5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.1.5-tuxcare.2 of org.springframework.security:spring-security-web. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 6.1.5 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4vrc-j85c-598c (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.1.5-tuxcare.2" } ], "bom-ref": "urn:uuid:a6cdec1d-80d6-5429-a1e4-cad03c460204", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41706 affects version 6.1.5-tuxcare.2 of org.springframework.security:spring-security-web, and is fixed in 6.1.5-tuxcare.3." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.1.5-tuxcare.2" } ], "bom-ref": "urn:uuid:3aa2348d-4b84-5933-ae05-dff96ee442e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47838 affects version 6.1.5-tuxcare.2 of org.springframework.security:spring-security-web, and is fixed in 6.1.5-tuxcare.3." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.1.5-tuxcare.2" } ], "bom-ref": "urn:uuid:08de78cc-8034-5918-9552-74b02a0ba1ae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 6.1.5-tuxcare.2 of org.springframework.security:spring-security-web. Prechecker: No vulnerable code from the fix was found; the vulnerable lines are absent, this version declares none of the classes the fix changes, and their base package is absent. Version 6.1.5 is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only).", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.1.5-tuxcare.2" } ] }