{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:477ef878-f93a-5343-a868-2860a4dd8123", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2", "version": "6.3.9-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@6.3.9", "type": "library", "group": "org.springframework.security", "version": "6.3.9" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:24f1ef7a-32bb-5df8-8745-036febd271d4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22112 does not affect version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web. CVE-2021-22112 does not affect Spring Security 6.3.9. The vulnerability, which allowed SecurityContext changes to not be saved when modified multiple times in a single request, was fixed in upstream Spring Security 5.4.4 (January 2021). The fix was already present in the upstream 6.3.9 release that TuxCare onboarded. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:dce3f52f-9038-5cb7-ad43-7c7cc865580e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22978 does not affect version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web. Spring Security 6.3.9 is NOT affected by CVE-2022-22978. The vulnerability (RegexRequestMatcher bypass via newline injection) was fixed in upstream commit 472c25b5e8 by Rob Winch, which changed `DEFAULT = 0` to `DEFAULT = Pattern.DOTALL`. This fix was already present in the upstream Spring Security 6.3.9 release when TuxCare onboarded it (first TuxCare commit: 9da422fa4f \"Onboard version 6.3.9\"). The target code correctly uses `Pattern.DOTALL` flag when compiling regex patterns, ensuring that `.` matches newline characters and preventing authorization bypass attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:ef46b3d1-50a8-57a6-8127-8085639d8179", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38821 does not affect version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web. Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. The upstream fix was released in 6.3.4, and version 6.3.9 is a later release of the same line. Advisories: GitHub GHSA-c4q5-6c82-3qpw (fixed in 6.3.4), CVE record (fixed in 6.3.4), Snyk (fixed in 6.3.4).", "justification": "code_not_present" } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:cc84549a-3be4-59fb-911f-f18a87e5cc08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:e6ebb077-2ad0-5964-ade6-8e702f944da1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22747 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:6b61201c-8644-5536-ab19-5aeb01c82bf7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web. Spring Security 6.3.9 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcherFactoryBean (introduced in version 7.0.x) where the builder's basePath() return value is not captured, causing servlet-path configuration to be lost. Version 6.3.9 uses a completely different architecture: MvcRequestMatcher for servlet-path handling, with no builder assignment bug. The vulnerable class PathPatternRequestMatcherFactoryBean does not exist in 6.3.9.", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:1f20de58-c6a0-593b-a43c-2b08edecb1e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:db2491d2-70eb-5fa6-962a-d5d418e3ab6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:e4b8c86f-6432-57d1-8903-30cd9505707d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47841 does not affect version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 6.3.9 contains no WebAuthn code, so it is not affected.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.3.9-tuxcare.2" } ] }