{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e58dddde-c34b-5d49-9a23-4a8129741ea9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-data", "purl": "pkg:maven/org.springframework.security/spring-security-data@6.3.9-tuxcare.2", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.9-tuxcare.2", "version": "6.3.9-tuxcare.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:a0839824-9e82-5178-aded-fa5a6b369233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:286d0d6c-ee33-5416-a16b-abab46e8e4d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:4a72ce65-f73e-510e-a1c4-59ba06f5e902", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22747 affects version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-22748", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:b4e0f250-369f-56ad-83d6-c76212e495e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22748 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-22753", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:213bdc5c-1060-5ee5-ba78-7bc26a8a218e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22753 does not affect version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-data. Spring Security 6.3.9 is NOT AFFECTED by CVE-2026-22753. The vulnerability requires PathPatternRequestMatcher and PathPatternRequestMatcher.Builder classes introduced in Spring Security 7.0+. Version 6.3.9 uses a fundamentally different request matching architecture (MvcRequestMatcher/AntPathRequestMatcher) that predates the vulnerable infrastructure. The vulnerable pattern\u2014ignoring user-provided PathPatternRequestMatcher.Builder beans with configured base paths\u2014cannot exist because these classes and the bean-based configuration mechanism do not exist in 6.3.9. Exhaustive searches confirmed the absence of the vulnerable component.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:3ac7d662-8a8e-508e-8569-7dc8c83d0542", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-data. Spring Security 6.3.9 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcherFactoryBean (introduced in version 7.0.x) where the builder's basePath() return value is not captured, causing servlet-path configuration to be lost. Version 6.3.9 uses a completely different architecture: MvcRequestMatcher for servlet-path handling, with no builder assignment bug. The vulnerable class PathPatternRequestMatcherFactoryBean does not exist in 6.3.9.", "justification": "code_not_present" } }, { "id": "CVE-2026-40988", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:a8cdf157-3a9f-545e-bdb4-6bc1ea70b592", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40988 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-40993", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:880fd207-2133-59b6-9492-94e70aaa818d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40993 does not affect version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-data. Spring Security 6.3.9 is not affected by CVE-2026-40993. The vulnerable component `JdbcAssertingPartyMetadataRepository` does not exist in this version. This JDBC-backed SAML2 asserting party metadata storage feature, which deserializes credentials from database columns, was introduced in Spring Security 7.0.x. Version 6.3.9 only provides in-memory storage via `InMemoryRelyingPartyRegistrationRepository` with no serialization or JDBC interaction for SAML2 credentials.", "justification": "code_not_present" } }, { "id": "CVE-2026-41003", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:00f7b7d6-e9e0-523d-80dc-823381955209", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41003 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-41694", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:4667eec9-83e0-573a-a9aa-4bcaede10771", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41694 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:60bdeec2-4513-513a-877e-aa27f7419f03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41706 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:e1403adf-5d1e-51fc-ba38-3b29063b7be9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:84645d22-4370-5110-a4fc-c76572dad427", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-59270", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:c45eec97-7c7d-5ee1-a951-ca321c05ce68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59270 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-data." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.9-tuxcare.2" } ], "bom-ref": "urn:uuid:e964ee4c-3bf4-51ee-bf0c-130dd2c0692e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59276 is fixed in version 6.3.9-tuxcare.2 of org.springframework.security:spring-security-data." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-data@6.3.9-tuxcare.2" } ] }