{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1f33fc0a-0eae-59de-ac55-0ee29fe115c1", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework.boot/spring-boot-starter-oauth2-resource-server@2.7.18-tuxcare.18", "type": "library", "group": "org.springframework.boot", "name": "spring-boot-starter-oauth2-resource-server", "version": "2.7.18-tuxcare.18", "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-oauth2-resource-server@2.7.18-tuxcare.18" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:fd6143b0-1238-5ae1-8824-1ae5ef9a733e", "id": "CVE-2023-38286", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-38286 is fixed in version 2.7.18-tuxcare.18 of org.springframework.boot:spring-boot-starter-oauth2-resource-server." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-oauth2-resource-server@2.7.18-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:86dd7e84-e259-51a2-8c0b-9dcae45959a2", "id": "CVE-2024-38807", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38807 is fixed in version 2.7.18-tuxcare.18 of org.springframework.boot:spring-boot-starter-oauth2-resource-server." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-oauth2-resource-server@2.7.18-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:73d81028-5a9d-5ee2-a627-6a34f05d505c", "id": "CVE-2025-22235", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22235 is fixed in version 2.7.18-tuxcare.18 of org.springframework.boot:spring-boot-starter-oauth2-resource-server." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-oauth2-resource-server@2.7.18-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:c1195918-1974-5c0e-8ee4-66282ee79238", "id": "CVE-2026-22733", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22733 is fixed in version 2.7.18-tuxcare.18 of org.springframework.boot:spring-boot-starter-oauth2-resource-server." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-oauth2-resource-server@2.7.18-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:b21eaf55-32fd-5766-ae2c-4a56841e4620", "id": "CVE-2026-40972", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40972 is fixed in version 2.7.18-tuxcare.18 of org.springframework.boot:spring-boot-starter-oauth2-resource-server." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-oauth2-resource-server@2.7.18-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:34d36815-5812-5f1f-9687-65e84cbac1d2", "id": "CVE-2026-40973", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40973 is fixed in version 2.7.18-tuxcare.18 of org.springframework.boot:spring-boot-starter-oauth2-resource-server." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-oauth2-resource-server@2.7.18-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:12ec453d-3475-5f41-b7c7-842a38ecdf99", "id": "CVE-2026-40974", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40974 is fixed in version 2.7.18-tuxcare.18 of org.springframework.boot:spring-boot-starter-oauth2-resource-server." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-oauth2-resource-server@2.7.18-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:50626d26-80a8-5af5-ac6e-4c660acffeef", "id": "CVE-2026-40975", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40975 is fixed in version 2.7.18-tuxcare.18 of org.springframework.boot:spring-boot-starter-oauth2-resource-server." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-oauth2-resource-server@2.7.18-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:e27e7296-8f45-56bc-a432-8ff24e8b5cb7", "id": "CVE-2026-40977", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40977 is fixed in version 2.7.18-tuxcare.18 of org.springframework.boot:spring-boot-starter-oauth2-resource-server." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-oauth2-resource-server@2.7.18-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:d6d12cb1-38f7-52b5-b279-3ca6b531623f", "id": "CVE-2026-40992", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40992 does not affect version 2.7.18-tuxcare.18 of org.springframework.boot:spring-boot-starter-oauth2-resource-server. not_affected \u2014 Spring Boot 2.7.18 is NOT AFFECTED by CVE-2026-40992. The vulnerability exists in the SSL auto-configuration feature (spring.mail.ssl.*) introduced in Spring Boot 3.4+/3.5+/4.0+, which does not exist in version 2.7.18. The target version uses a simpler architecture where all SSL configuration is manual via spring.mail.properties.*, and the auto-configuration does not handle SSL at all." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-oauth2-resource-server@2.7.18-tuxcare.18" } ] }, { "bom-ref": "urn:uuid:a5c26fa1-69ac-5270-8984-5aeef5b5da4a", "id": "CVE-2026-41001", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41001 affects version 2.7.18-tuxcare.18 of org.springframework.boot:spring-boot-starter-oauth2-resource-server." }, "affects": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-oauth2-resource-server@2.7.18-tuxcare.18" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.boot/spring-boot-starter-oauth2-resource-server@2.7.18-tuxcare.18" } ] }