{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d317a9ad-db67-5c6a-8d37-6f0f2abb34eb", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-security-saml2-service-provider", "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.13-tuxcare.4", "type": "library", "group": "org.springframework.security", "bom-ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.13-tuxcare.4", "version": "6.4.13-tuxcare.4", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2026-22732", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:50c520fc-0d6c-5a18-8476-d3a1ea46fd30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider." } }, { "id": "CVE-2026-22746", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:9e465e73-2b5d-544e-9cc6-4a1f55a67fb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider." } }, { "id": "CVE-2026-22747", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:76ad1b72-eed7-5588-8500-6673102069cf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22747 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider. Spring Security 6.4.13 is outside the affected range (7.0.0\u20137.0.4). CVE-2026-22747 affects the DN parsing logic in SubjectX500PrincipalExtractor, which can incorrectly extract a username from a certificate subject. This class and its associated authentication path are absent in 6.4.13, where X.509 authentication uses SubjectDnX509PrincipalExtractor instead. Therefore, the vulnerable code path does not exist in this version." } }, { "id": "CVE-2026-22748", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:472e8957-59e9-5088-8d72-98372151d4f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22748 is fixed in version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider." } }, { "id": "CVE-2026-22751", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:b322db0d-481f-5be5-931d-ba1f0c2821e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22751 is fixed in version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider." } }, { "id": "CVE-2026-22753", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:b0852af5-a7a7-53a9-85f9-c7e9ff806dea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22753 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider. not_affected \u2014 Spring Security 6.4.13 is not affected by CVE-2026-22753. This vulnerability is specific to the PathPatternRequestMatcher.Builder bean feature introduced in Spring Security 7.0.0. Version 6.4.13 uses a different architecture (MvcRequestMatcher with automatic servlet path detection) that does not have this vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-22754", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:a7e3ed93-578a-5efd-b701-a329848ea8f5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22754 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider. not_affected \u2014 Spring Security 6.4.13 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a bug in PathPatternRequestMatcherFactoryBean where the builder's basePath() method is called without capturing its return value. Version 6.4.13 does not contain PathPatternRequestMatcher or PathPatternRequestMatcherFactoryBean classes. Instead, it uses the older MvcRequestMa...", "justification": "code_not_present" } }, { "id": "CVE-2026-40988", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:2ab1ccf8-89e0-54bd-957e-fca6e78194f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-40988 affects version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider." } }, { "id": "CVE-2026-40993", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:9f824f00-f7c7-5a97-850f-7013c5b69362", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40993 does not affect version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider. Spring Security 6.4.13 is not affected by CVE-2026-40993. The vulnerable component JdbcAssertingPartyMetadataRepository does not exist in this version. This JDBC-based repository for storing SAML2 asserting party metadata in a database was introduced in Spring Security 7.0.x. Version 6.4.13 only provides in-memory and OpenSAML-based metadata repositories that do not involve database deserialization of credentials.", "justification": "code_not_present" } }, { "id": "CVE-2026-41003", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:8fe76958-67df-591e-93b2-56711c4cdaca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41003 is fixed in version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider." } }, { "id": "CVE-2026-41694", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:ee9a6722-13ae-5d0f-b549-c50d5dc94520", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41694 is fixed in version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider." } }, { "id": "CVE-2026-41706", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:91c21ea7-93e8-5927-a3b2-7636a390d8b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41706 affects version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider." } }, { "id": "CVE-2026-47838", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:bfea0abe-9f0c-551f-acd0-55ef6910920a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider." } }, { "id": "CVE-2026-47841", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:ada32d08-b738-5906-a219-405f667b75c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47841 affects version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider." } }, { "id": "CVE-2026-47842", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:d6e7576a-d0ee-55ea-842c-5dd18e53b9a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47842 affects version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider." } }, { "id": "CVE-2026-59270", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:5c4d08ea-17ac-5c02-ad8c-181c0b609f8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59270 is fixed in version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider." } }, { "id": "CVE-2026-59276", "affects": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.13-tuxcare.4" } ], "bom-ref": "urn:uuid:84a46b0a-a4b9-5866-9197-7958eebc8b7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59276 affects version 6.4.13-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.13-tuxcare.4" } ] }