{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1c8161aa-ef8c-5dae-a66e-911e6855d712", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@6.4.13-tuxcare.8", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-web@6.4.13-tuxcare.8", "version": "6.4.13-tuxcare.8", "pedigree": { "ancestors": [ { "name": "spring-security-web", "purl": "pkg:maven/org.springframework.security/spring-security-web@6.4.13", "type": "library", "group": "org.springframework.security", "version": "6.4.13" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2021-22112", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.4.13-tuxcare.8" } ], "bom-ref": "urn:uuid:8c7ce8f3-a5a3-508a-922d-9dec2f2b4253", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22112 does not affect version 6.4.13-tuxcare.8 of org.springframework.security:spring-security-web. Spring Security 6.4.13 is not affected by CVE-2021-22112. The vulnerability was fixed in upstream Spring Security versions 5.4.4, 5.3.8, and 5.2.9 (released in early 2021). Version 6.4.13 includes the upstream fix that prevents SecurityContext from failing to save when changed multiple times in a single request. The fix (commit c72a6fac04) introduced the isSaveContextInvoked flag mechanism, which is present in the target code at lines 358, 409, 429, and 435 of HttpSessionSecurityContextRepository.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2022-22978", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.4.13-tuxcare.8" } ], "bom-ref": "urn:uuid:bb8eb076-5ac4-5594-b52a-2fcacf2a4748", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22978 does not affect version 6.4.13-tuxcare.8 of org.springframework.security:spring-security-web. CVE-2022-22978 is not present in Spring Security 6.4.13. The vulnerability involved RegexRequestMatcher's pattern matching bypassed by paths containing newline characters (\\n, \\r) because the regex `.` metacharacter didn't match line separators by default. The upstream fix (commit c6461d61ba, May 2022) changed DEFAULT from 0 to Pattern.DOTALL, making `.` match all characters including newlines. This fix was already included in the Spring Security 6.4.13 upstream release that TuxCare onboarded. The target repository at SHA 6c83e2d405 contains the fixed code with Pattern.DOTALL set as the default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-38821", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.4.13-tuxcare.8" } ], "bom-ref": "urn:uuid:f9b546a9-4508-5c27-ab63-0f5705caf374", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38821 does not affect version 6.4.13-tuxcare.8 of org.springframework.security:spring-security-web. Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. Version 6.4.13 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-c4q5-6c82-3qpw (affected up to 6.3.4), CVE record (affected up to 6.3.4), Snyk (affected up to 6.3.4).", "justification": "code_not_present" } }, { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.4.13-tuxcare.8" } ], "bom-ref": "urn:uuid:c4351123-96e0-55a8-9093-82f39c5f3f6c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.4.13-tuxcare.8 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.4.13-tuxcare.8" } ], "bom-ref": "urn:uuid:9dcc50ab-5d04-57d2-801c-9cf7dd71c452", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22747 does not affect version 6.4.13-tuxcare.8 of org.springframework.security:spring-security-web. Spring Security 6.4.13 is outside the affected range (7.0.0\u20137.0.4). CVE-2026-22747 affects the DN parsing logic in SubjectX500PrincipalExtractor, which can incorrectly extract a username from a certificate subject. This class and its associated authentication path are absent in 6.4.13, where X.509 authentication uses SubjectDnX509PrincipalExtractor instead. Therefore, the vulnerable code path does not exist in this version." } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.4.13-tuxcare.8" } ], "bom-ref": "urn:uuid:efe6f9bd-56f9-56df-a58b-bb219eabac68", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.4.13-tuxcare.8 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 6.4.13 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a bug in PathPatternRequestMatcherFactoryBean where the builder's basePath() method is called without capturing its return value. Version 6.4.13 does not contain PathPatternRequestMatcher or PathPatternRequestMatcherFactoryBean classes. Instead, it uses the older MvcRequestMa...", "justification": "code_not_present" } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.4.13-tuxcare.8" } ], "bom-ref": "urn:uuid:8c47a75f-9bca-5312-99ed-ebdad489e8d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.4.13-tuxcare.8 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.4.13-tuxcare.8" } ], "bom-ref": "urn:uuid:4c594c99-56df-5640-9aff-eb303476624e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.4.13-tuxcare.8 of org.springframework.security:spring-security-web." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.4.13-tuxcare.8" } ], "bom-ref": "urn:uuid:a5a26cf5-6685-55a7-b22b-99cc22c03841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47841 is fixed in version 6.4.13-tuxcare.8 of org.springframework.security:spring-security-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-web@6.4.13-tuxcare.8" } ] }