{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7b04821b-0384-56d3-a405-d505ca3f104a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@6.2.7-tuxcare.6", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.7-tuxcare.6", "version": "6.2.7-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@6.2.7", "type": "library", "group": "org.springframework.security", "version": "6.2.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.7-tuxcare.6" } ], "bom-ref": "urn:uuid:635492e6-b999-520a-9449-12a71d597f8d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22112 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-web. CVE-2021-22112 affects Spring Security versions that fail to save the SecurityContext when it is changed more than once in a single request. The target repository (Spring Security 6.2.7-tuxcare.8) already contains the upstream fix introduced in commit 3116369f027 by Rob Winch on 2021-01-22. This fix adds a `isSaveContextInvoked` flag to track saveContext() invocations and modifies the contextChanged() method to ensure all context changes are persisted. Since the fix was already present in the upstream release that TuxCare onboarded (before the first TuxCare commit f09fc6dd88), the target is not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.7-tuxcare.6" } ], "bom-ref": "urn:uuid:86085ee6-6ab9-5783-b31e-63039f08ab27", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22978 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-web. CVE-2022-22978: Target version 6.2.7 is NOT AFFECTED. The vulnerability (RegexRequestMatcher using Pattern flag 0 instead of Pattern.DOTALL, allowing newline characters in URLs to bypass regex authorization checks) was fixed in upstream Spring Security commit c6461d61ba (May 13, 2022) before the 6.2.7 release. The fix was already present when TuxCare onboarded version 6.2.7 on July 26, 2026 (commit 2a37cf61b4 by evasilev@cloudlinux.com). The target code at HEAD (6d971abbe2) shows the fix is present: `private static final int DEFAULT = Pattern.DOTALL;` at line 46 of RegexRequestMatcher.java. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.7-tuxcare.6" } ], "bom-ref": "urn:uuid:1d219e8d-33ba-5102-9c00-09e554123ea1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38821 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-web. Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. The upstream fix was released in 6.2.7, which is this version. Advisories: GitHub GHSA-c4q5-6c82-3qpw (fixed in 6.2.7), CVE record (fixed in 6.2.7), Snyk (fixed in 6.2.7).", "justification": "code_not_present" } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.7-tuxcare.6" } ], "bom-ref": "urn:uuid:8fce7a49-4ce3-5dac-9448-366161ffddd3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.7-tuxcare.6" } ], "bom-ref": "urn:uuid:90eaf2a1-c60e-51e2-b96e-701e52b09167", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22747 affects version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.7-tuxcare.6" } ], "bom-ref": "urn:uuid:ed460a25-3b27-596f-ad11-cfcad91fab16", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 6.2.7 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean (introduced in 7.x) where basePath assignment was missing. Version 6.2.7 uses a different architecture (MvcRequestMatcher for servlet-path handling) that does not have this vulnerability pattern.", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.7-tuxcare.6" } ], "bom-ref": "urn:uuid:51ead146-da7f-5c8a-ba0c-34468c51a878", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.7-tuxcare.6" } ], "bom-ref": "urn:uuid:8876816b-0135-55a7-8219-4c4e3c81b16e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.7-tuxcare.6" } ], "bom-ref": "urn:uuid:c224438e-5e56-5423-a004-ba4fb3eb6601", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 6.2.7 contains no WebAuthn code, so it is not affected.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.2.7-tuxcare.6" } ] }