{"id":"CVE-2026-47842","aliases":["CLSA-2026-1792063694","CLSA-2026-1792068377","CLSA-2026-1792072377","CLSA-2026-1792073875","CLSA-2026-1792077066","CLSA-2026-1792077163","CLSA-2026-1792077209","CLSA-2026-1792077256","CLSA-2026-1792077565","CLSA-2026-1792079338","CLSA-2026-1792079446","CLSA-2026-1792079757","CLSA-2026-1792080021","CLSA-2026-1792084952","CLSA-2026-1792085061","CLSA-2026-1792089227","CLSA-2026-1792089645","CLSA-2026-1792099468","CLSA-2026-1792099521","CLSA-2026-1792099598","CLSA-2026-1792099763","CLSA-2026-1792099789","CLSA-2026-1792102802","CLSA-2026-1792502421","CLSA-2026-1792503291","CLSA-2026-1794175722","CLSA-2026-1794189026","CLSA-2026-1794189800","CLSA-2026-1794244725","CLSA-2026-1794245422","CLSA-2026-1794246204","EUVD-2026-66677","GHSA-7274-w8xr-fr2w"],"status":"published","title":"Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation","description":"Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0015,"percentile":0.04207,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-326"],"published":"2026-08-26T19:22:23Z","modified":"2026-11-10T01:15:04Z","affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3"},{"fixed":"6.4.3-tuxcare.10"}]}],"versions":["6.4.3","6.4.3-tuxcare.1","6.4.3-tuxcare.2","6.4.3-tuxcare.3","6.4.3-tuxcare.4","6.4.3-tuxcare.5","6.4.3-tuxcare.6","6.4.3-tuxcare.7","6.4.3-tuxcare.8","6.4.3-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3"},{"fixed":"6.4.3-tuxcare.10"}]}],"versions":["6.4.3","6.4.3-tuxcare.1","6.4.3-tuxcare.2","6.4.3-tuxcare.3","6.4.3-tuxcare.4","6.4.3-tuxcare.5","6.4.3-tuxcare.6","6.4.3-tuxcare.7","6.4.3-tuxcare.8","6.4.3-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3"},{"fixed":"6.4.3-tuxcare.10"}]}],"versions":["6.4.3","6.4.3-tuxcare.1","6.4.3-tuxcare.2","6.4.3-tuxcare.3","6.4.3-tuxcare.4","6.4.3-tuxcare.5","6.4.3-tuxcare.6","6.4.3-tuxcare.7","6.4.3-tuxcare.8","6.4.3-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3"},{"fixed":"6.4.3-tuxcare.10"}]}],"versions":["6.4.3","6.4.3-tuxcare.1","6.4.3-tuxcare.2","6.4.3-tuxcare.3","6.4.3-tuxcare.4","6.4.3-tuxcare.5","6.4.3-tuxcare.6","6.4.3-tuxcare.7","6.4.3-tuxcare.8","6.4.3-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.13"},{"fixed":"6.4.13-tuxcare.6"}]}],"versions":["6.4.13","6.4.13-tuxcare.1","6.4.13-tuxcare.2","6.4.13-tuxcare.3","6.4.13-tuxcare.4","6.4.13-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.13"},{"fixed":"6.4.13-tuxcare.6"}]}],"versions":["6.4.13","6.4.13-tuxcare.1","6.4.13-tuxcare.2","6.4.13-tuxcare.3","6.4.13-tuxcare.4","6.4.13-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.13"},{"fixed":"6.4.13-tuxcare.6"}]}],"versions":["6.4.13","6.4.13-tuxcare.1","6.4.13-tuxcare.2","6.4.13-tuxcare.3","6.4.13-tuxcare.4","6.4.13-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.13"},{"fixed":"6.4.13-tuxcare.6"}]}],"versions":["6.4.13","6.4.13-tuxcare.1","6.4.13-tuxcare.2","6.4.13-tuxcare.3","6.4.13-tuxcare.4","6.4.13-tuxcare.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.11"},{"fixed":"6.5.11-tuxcare.3"}]}],"versions":["6.5.11","6.5.11-tuxcare.1","6.5.11-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.11"},{"fixed":"6.5.11-tuxcare.3"}]}],"versions":["6.5.11","6.5.11-tuxcare.1","6.5.11-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.11"},{"fixed":"6.5.11-tuxcare.3"}]}],"versions":["6.5.11","6.5.11-tuxcare.1","6.5.11-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.11"},{"fixed":"6.5.11-tuxcare.3"}]}],"versions":["6.5.11","6.5.11-tuxcare.1","6.5.11-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.10"},{"fixed":"6.3.10-tuxcare.20"}]}],"versions":["6.3.10","6.3.10-tuxcare.1","6.3.10-tuxcare.10","6.3.10-tuxcare.11","6.3.10-tuxcare.12","6.3.10-tuxcare.13","6.3.10-tuxcare.14","6.3.10-tuxcare.15","6.3.10-tuxcare.16","6.3.10-tuxcare.17","6.3.10-tuxcare.18","6.3.10-tuxcare.19","6.3.10-tuxcare.2","6.3.10-tuxcare.3","6.3.10-tuxcare.4","6.3.10-tuxcare.5","6.3.10-tuxcare.6","6.3.10-tuxcare.7","6.3.10-tuxcare.8","6.3.10-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.10"},{"fixed":"6.3.10-tuxcare.20"}]}],"versions":["6.3.10","6.3.10-tuxcare.1","6.3.10-tuxcare.10","6.3.10-tuxcare.11","6.3.10-tuxcare.12","6.3.10-tuxcare.13","6.3.10-tuxcare.14","6.3.10-tuxcare.15","6.3.10-tuxcare.16","6.3.10-tuxcare.17","6.3.10-tuxcare.18","6.3.10-tuxcare.19","6.3.10-tuxcare.2","6.3.10-tuxcare.3","6.3.10-tuxcare.4","6.3.10-tuxcare.5","6.3.10-tuxcare.6","6.3.10-tuxcare.7","6.3.10-tuxcare.8","6.3.10-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.8"},{"fixed":"6.0.8-tuxcare.4"}]}],"versions":["6.0.8","6.0.8-tuxcare.1","6.0.8-tuxcare.2","6.0.8-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.8"},{"fixed":"6.0.8-tuxcare.4"}]}],"versions":["6.0.8","6.0.8-tuxcare.1","6.0.8-tuxcare.2","6.0.8-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.8"},{"fixed":"6.0.8-tuxcare.4"}]}],"versions":["6.0.8","6.0.8-tuxcare.1","6.0.8-tuxcare.2","6.0.8-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.8"},{"fixed":"6.0.8-tuxcare.4"}]}],"versions":["6.0.8","6.0.8-tuxcare.1","6.0.8-tuxcare.2","6.0.8-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.8"},{"fixed":"6.0.8-tuxcare.4"}]}],"versions":["6.0.8","6.0.8-tuxcare.1","6.0.8-tuxcare.2","6.0.8-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.2"},{"fixed":"6.2.2-tuxcare.8"}]}],"versions":["6.2.2","6.2.2-tuxcare.1","6.2.2-tuxcare.2","6.2.2-tuxcare.3","6.2.2-tuxcare.4","6.2.2-tuxcare.5","6.2.2-tuxcare.6","6.2.2-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.2"},{"fixed":"6.2.2-tuxcare.8"}]}],"versions":["6.2.2","6.2.2-tuxcare.1","6.2.2-tuxcare.2","6.2.2-tuxcare.3","6.2.2-tuxcare.4","6.2.2-tuxcare.5","6.2.2-tuxcare.6","6.2.2-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.2"},{"fixed":"6.2.2-tuxcare.8"}]}],"versions":["6.2.2","6.2.2-tuxcare.1","6.2.2-tuxcare.2","6.2.2-tuxcare.3","6.2.2-tuxcare.4","6.2.2-tuxcare.5","6.2.2-tuxcare.6","6.2.2-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.7"}]}],"versions":["6.2.7","6.2.7-tuxcare.1","6.2.7-tuxcare.2","6.2.7-tuxcare.3","6.2.7-tuxcare.4","6.2.7-tuxcare.5","6.2.7-tuxcare.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.7"}]}],"versions":["6.2.7","6.2.7-tuxcare.1","6.2.7-tuxcare.2","6.2.7-tuxcare.3","6.2.7-tuxcare.4","6.2.7-tuxcare.5","6.2.7-tuxcare.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.7"}]}],"versions":["6.2.7","6.2.7-tuxcare.1","6.2.7-tuxcare.2","6.2.7-tuxcare.3","6.2.7-tuxcare.4","6.2.7-tuxcare.5","6.2.7-tuxcare.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.9"},{"fixed":"6.3.9-tuxcare.2"}]}],"versions":["6.3.9","6.3.9-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.9"},{"fixed":"6.3.9-tuxcare.2"}]}],"versions":["6.3.9","6.3.9-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.9"},{"fixed":"6.3.9-tuxcare.2"}]}],"versions":["6.3.9","6.3.9-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.8"},{"fixed":"6.2.8-tuxcare.5"}]}],"versions":["6.2.8","6.2.8-tuxcare.1","6.2.8-tuxcare.2","6.2.8-tuxcare.3","6.2.8-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.8"},{"fixed":"6.2.8-tuxcare.5"}]}],"versions":["6.2.8","6.2.8-tuxcare.1","6.2.8-tuxcare.2","6.2.8-tuxcare.3","6.2.8-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.8"},{"fixed":"6.2.8-tuxcare.5"}]}],"versions":["6.2.8","6.2.8-tuxcare.1","6.2.8-tuxcare.2","6.2.8-tuxcare.3","6.2.8-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.16"},{"fixed":"5.8.16-tuxcare.16"}]}],"versions":["5.8.16","5.8.16-tuxcare.10","5.8.16-tuxcare.11","5.8.16-tuxcare.12","5.8.16-tuxcare.13","5.8.16-tuxcare.14","5.8.16-tuxcare.15","5.8.16-tuxcare.4","5.8.16-tuxcare.5","5.8.16-tuxcare.6","5.8.16-tuxcare.7","5.8.16-tuxcare.8","5.8.16-tuxcare.9","5.8.16.tuxcare","5.8.16.tuxcare.1","5.8.16.tuxcare.2","5.8.16.tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.16"},{"fixed":"5.8.16-tuxcare.16"}]}],"versions":["5.8.16","5.8.16-tuxcare.10","5.8.16-tuxcare.11","5.8.16-tuxcare.12","5.8.16-tuxcare.13","5.8.16-tuxcare.14","5.8.16-tuxcare.15","5.8.16-tuxcare.4","5.8.16-tuxcare.5","5.8.16-tuxcare.6","5.8.16-tuxcare.7","5.8.16-tuxcare.8","5.8.16-tuxcare.9","5.8.16.tuxcare","5.8.16.tuxcare.1","5.8.16.tuxcare.2","5.8.16.tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.7"},{"fixed":"6.0.7-tuxcare.1"}]}],"versions":["6.0.7"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.7"},{"fixed":"6.0.7-tuxcare.1"}]}],"versions":["6.0.7"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.7"},{"fixed":"6.0.7-tuxcare.1"}]}],"versions":["6.0.7"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.7"},{"fixed":"6.0.7-tuxcare.1"}]}],"versions":["6.0.7"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.7"},{"fixed":"6.0.7-tuxcare.1"}]}],"versions":["6.0.7"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.6"},{"fixed":"6.1.6-tuxcare.8"}]}],"versions":["6.1.6","6.1.6-tuxcare.1","6.1.6-tuxcare.2","6.1.6-tuxcare.3","6.1.6-tuxcare.4","6.1.6-tuxcare.5","6.1.6-tuxcare.6","6.1.6-tuxcare.7"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.6"},{"fixed":"6.1.6-tuxcare.8"}]}],"versions":["6.1.6","6.1.6-tuxcare.1","6.1.6-tuxcare.2","6.1.6-tuxcare.3","6.1.6-tuxcare.4","6.1.6-tuxcare.5","6.1.6-tuxcare.6","6.1.6-tuxcare.7"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.6"},{"fixed":"6.1.6-tuxcare.8"}]}],"versions":["6.1.6","6.1.6-tuxcare.1","6.1.6-tuxcare.2","6.1.6-tuxcare.3","6.1.6-tuxcare.4","6.1.6-tuxcare.5","6.1.6-tuxcare.6","6.1.6-tuxcare.7"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.6"},{"fixed":"6.1.6-tuxcare.8"}]}],"versions":["6.1.6","6.1.6-tuxcare.1","6.1.6-tuxcare.2","6.1.6-tuxcare.3","6.1.6-tuxcare.4","6.1.6-tuxcare.5","6.1.6-tuxcare.6","6.1.6-tuxcare.7"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.6"},{"fixed":"6.1.6-tuxcare.8"}]}],"versions":["6.1.6","6.1.6-tuxcare.1","6.1.6-tuxcare.2","6.1.6-tuxcare.3","6.1.6-tuxcare.4","6.1.6-tuxcare.5","6.1.6-tuxcare.6","6.1.6-tuxcare.7"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.14"},{"fixed":"5.8.14-tuxcare.3"}]}],"versions":["5.8.14","5.8.14-tuxcare.1","5.8.14-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.14"},{"fixed":"5.8.14-tuxcare.3"}]}],"versions":["5.8.14","5.8.14-tuxcare.1","5.8.14-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.15"},{"fixed":"5.8.15-tuxcare.2"}]}],"versions":["5.8.15","5.8.15.tuxcare","5.8.15.tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.15"},{"fixed":"5.8.15-tuxcare.2"}]}],"versions":["5.8.15","5.8.15.tuxcare","5.8.15.tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.15"},{"fixed":"5.8.15-tuxcare.2"}]}],"versions":["5.8.15","5.8.15.tuxcare","5.8.15.tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.15"},{"fixed":"5.8.15-tuxcare.2"}]}],"versions":["5.8.15","5.8.15.tuxcare","5.8.15.tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.15"},{"fixed":"5.8.15-tuxcare.2"}]}],"versions":["5.8.15","5.8.15.tuxcare","5.8.15.tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.14"},{"fixed":"5.7.14-tuxcare.8"}]}],"versions":["5.7.14","5.7.14-tuxcare.1","5.7.14-tuxcare.2","5.7.14-tuxcare.3","5.7.14-tuxcare.4","5.7.14-tuxcare.5","5.7.14-tuxcare.6","5.7.14-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.14"},{"fixed":"5.7.14-tuxcare.8"}]}],"versions":["5.7.14","5.7.14-tuxcare.1","5.7.14-tuxcare.2","5.7.14-tuxcare.3","5.7.14-tuxcare.4","5.7.14-tuxcare.5","5.7.14-tuxcare.6","5.7.14-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.14"},{"fixed":"5.7.14-tuxcare.8"}]}],"versions":["5.7.14","5.7.14-tuxcare.1","5.7.14-tuxcare.2","5.7.14-tuxcare.3","5.7.14-tuxcare.4","5.7.14-tuxcare.5","5.7.14-tuxcare.6","5.7.14-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.7"},{"fixed":"5.6.7-tuxcare.1"}]}],"versions":["5.6.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.7"},{"fixed":"5.6.7-tuxcare.1"}]}],"versions":["5.6.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.7"},{"fixed":"5.6.7-tuxcare.1"}]}],"versions":["5.6.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.7"},{"fixed":"5.6.7-tuxcare.1"}]}],"versions":["5.6.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.7"},{"fixed":"5.6.7-tuxcare.1"}]}],"versions":["5.6.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.7"},{"fixed":"5.7.7-tuxcare.2"}]}],"versions":["5.7.7","5.7.7-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.7"},{"fixed":"5.7.7-tuxcare.2"}]}],"versions":["5.7.7","5.7.7-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.7"},{"fixed":"5.7.7-tuxcare.2"}]}],"versions":["5.7.7","5.7.7-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.12"},{"fixed":"5.7.12-tuxcare.11"}]}],"versions":["5.7.12","5.7.12-tuxcare.1","5.7.12-tuxcare.10","5.7.12-tuxcare.2","5.7.12-tuxcare.3","5.7.12-tuxcare.4","5.7.12-tuxcare.5","5.7.12-tuxcare.6","5.7.12-tuxcare.7","5.7.12-tuxcare.8","5.7.12-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.12"},{"fixed":"5.7.12-tuxcare.11"}]}],"versions":["5.7.12","5.7.12-tuxcare.1","5.7.12-tuxcare.10","5.7.12-tuxcare.2","5.7.12-tuxcare.3","5.7.12-tuxcare.4","5.7.12-tuxcare.5","5.7.12-tuxcare.6","5.7.12-tuxcare.7","5.7.12-tuxcare.8","5.7.12-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.9"},{"fixed":"5.6.9-tuxcare.2"}]}],"versions":["5.6.9","5.6.9-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.9"},{"fixed":"5.6.9-tuxcare.2"}]}],"versions":["5.6.9","5.6.9-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.9"},{"fixed":"5.6.9-tuxcare.2"}]}],"versions":["5.6.9","5.6.9-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.10"},{"fixed":"5.6.10-tuxcare.8"}]}],"versions":["5.6.10","5.6.10-tuxcare.1","5.6.10-tuxcare.2","5.6.10-tuxcare.3","5.6.10-tuxcare.4","5.6.10-tuxcare.5","5.6.10-tuxcare.6","5.6.10-tuxcare.7"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.10"},{"fixed":"5.6.10-tuxcare.8"}]}],"versions":["5.6.10","5.6.10-tuxcare.1","5.6.10-tuxcare.2","5.6.10-tuxcare.3","5.6.10-tuxcare.4","5.6.10-tuxcare.5","5.6.10-tuxcare.6","5.6.10-tuxcare.7"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.10"},{"fixed":"5.6.10-tuxcare.8"}]}],"versions":["5.6.10","5.6.10-tuxcare.1","5.6.10-tuxcare.2","5.6.10-tuxcare.3","5.6.10-tuxcare.4","5.6.10-tuxcare.5","5.6.10-tuxcare.6","5.6.10-tuxcare.7"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.10"},{"fixed":"5.6.10-tuxcare.8"}]}],"versions":["5.6.10","5.6.10-tuxcare.1","5.6.10-tuxcare.2","5.6.10-tuxcare.3","5.6.10-tuxcare.4","5.6.10-tuxcare.5","5.6.10-tuxcare.6","5.6.10-tuxcare.7"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.8"},{"fixed":"5.5.8-tuxcare.2"}]}],"versions":["5.5.8","5.5.8-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.8"},{"fixed":"5.5.8-tuxcare.2"}]}],"versions":["5.5.8","5.5.8-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.8"},{"fixed":"5.5.8-tuxcare.2"}]}],"versions":["5.5.8","5.5.8-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.11"},{"fixed":"5.7.11-tuxcare.10"}]}],"versions":["5.7.11","5.7.11-tuxcare.1","5.7.11-tuxcare.2","5.7.11-tuxcare.3","5.7.11-tuxcare.4","5.7.11-tuxcare.5","5.7.11-tuxcare.6","5.7.11-tuxcare.7","5.7.11-tuxcare.8","5.7.11-tuxcare.9","5.7.11.tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.11"},{"fixed":"5.7.11-tuxcare.10"}]}],"versions":["5.7.11","5.7.11-tuxcare.1","5.7.11-tuxcare.2","5.7.11-tuxcare.3","5.7.11-tuxcare.4","5.7.11-tuxcare.5","5.7.11-tuxcare.6","5.7.11-tuxcare.7","5.7.11-tuxcare.8","5.7.11-tuxcare.9","5.7.11.tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.1"}]}],"versions":["5.1.5.RELEASE"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.1"}]}],"versions":["5.1.5.RELEASE"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.1"}]}],"versions":["5.1.5.RELEASE"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.1"}]}],"versions":["5.1.5.RELEASE"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.4.RELEASE"},{"fixed":"5.1.4.RELEASE-tuxcare.1"}]}],"versions":["5.1.4.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.4.RELEASE"},{"fixed":"5.1.4.RELEASE-tuxcare.1"}]}],"versions":["5.1.4.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.4.RELEASE"},{"fixed":"5.1.4.RELEASE-tuxcare.1"}]}],"versions":["5.1.4.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.4.RELEASE"},{"fixed":"5.1.4.RELEASE-tuxcare.1"}]}],"versions":["5.1.4.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.1"}]}],"versions":["5.1.6.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.1"}]}],"versions":["5.1.6.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.1"}]}],"versions":["5.1.6.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.1"}]}],"versions":["5.1.6.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.1"}]}],"versions":["5.1.6.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.5"},{"fixed":"5.6.5-tuxcare.2"}]}],"versions":["5.6.5","5.6.5-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.5"},{"fixed":"5.6.5-tuxcare.2"}]}],"versions":["5.6.5","5.6.5-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.5"},{"fixed":"5.6.5-tuxcare.2"}]}],"versions":["5.6.5","5.6.5-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.5"},{"fixed":"5.6.5-tuxcare.2"}]}],"versions":["5.6.5","5.6.5-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.5"},{"fixed":"5.6.5-tuxcare.2"}]}],"versions":["5.6.5","5.6.5-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.5"},{"fixed":"5.6.5-tuxcare.2"}]}],"versions":["5.6.5","5.6.5-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.6"},{"fixed":"5.7.6-tuxcare.2"}]}],"versions":["5.7.6","5.7.6-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.6"},{"fixed":"5.7.6-tuxcare.2"}]}],"versions":["5.7.6","5.7.6-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.6"},{"fixed":"5.7.6-tuxcare.2"}]}],"versions":["5.7.6","5.7.6-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.6"},{"fixed":"5.7.6-tuxcare.2"}]}],"versions":["5.7.6","5.7.6-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.6"},{"fixed":"5.7.6-tuxcare.2"}]}],"versions":["5.7.6","5.7.6-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.6"},{"fixed":"5.7.6-tuxcare.2"}]}],"versions":["5.7.6","5.7.6-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.7"},{"fixed":"5.5.7-tuxcare.2"}]}],"versions":["5.5.7","5.5.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.7"},{"fixed":"5.5.7-tuxcare.2"}]}],"versions":["5.5.7","5.5.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.7"},{"fixed":"5.5.7-tuxcare.2"}]}],"versions":["5.5.7","5.5.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.7"},{"fixed":"5.5.7-tuxcare.2"}]}],"versions":["5.5.7","5.5.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.7"},{"fixed":"5.5.7-tuxcare.2"}]}],"versions":["5.5.7","5.5.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.3"},{"fixed":"5.6.3-tuxcare.3"}]}],"versions":["5.6.3","5.6.3-tuxcare.1","5.6.3-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.3"},{"fixed":"5.6.3-tuxcare.3"}]}],"versions":["5.6.3","5.6.3-tuxcare.1","5.6.3-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.3"},{"fixed":"5.6.3-tuxcare.3"}]}],"versions":["5.6.3","5.6.3-tuxcare.1","5.6.3-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.3"},{"fixed":"5.6.3-tuxcare.3"}]}],"versions":["5.6.3","5.6.3-tuxcare.1","5.6.3-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.3"},{"fixed":"5.6.3-tuxcare.3"}]}],"versions":["5.6.3","5.6.3-tuxcare.1","5.6.3-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.2.RELEASE"},{"fixed":"5.1.2.RELEASE-tuxcare.2"}]}],"versions":["5.1.2.RELEASE","5.1.2.RELEASE-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.2.RELEASE"},{"fixed":"5.1.2.RELEASE-tuxcare.2"}]}],"versions":["5.1.2.RELEASE","5.1.2.RELEASE-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.2.RELEASE"},{"fixed":"5.1.2.RELEASE-tuxcare.2"}]}],"versions":["5.1.2.RELEASE","5.1.2.RELEASE-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.2.RELEASE"},{"fixed":"5.1.2.RELEASE-tuxcare.2"}]}],"versions":["5.1.2.RELEASE","5.1.2.RELEASE-tuxcare.1"],"bundled":8}],"products":[{"vendor":"spring","product":"spring security"},{"vendor":"vmware","product":"spring_security"}],"references":[{"url":"https://spring.io/security/cve-2026-47842","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47842","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7274-w8xr-fr2w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47842.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-47842","title":"Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation","description":"Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25","status":"published","published":"2026-08-26T19:22:23.745Z","modified":"2026-08-26T19:45:25.424Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T13:36:40.478484Z"}],"euvd":[{"id":"EUVD-2026-66677","description":"Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25","status":"published","published":"2026-08-26T19:22:23Z","modified":"2026-08-26T19:45:25Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:29.296861Z"}],"ghsa":[{"id":"GHSA-7274-w8xr-fr2w","title":"Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV...","description":"Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25","status":"published","published":"2026-08-26T21:31:43Z","modified":"2026-09-04T21:31:40Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T15:11:24.326884Z"}],"nvd":[{"id":"CVE-2026-47842","description":"Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25","status":"published","published":"2026-08-26T20:17:25.753Z","modified":"2026-09-04T19:34:25.73Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T14:12:41.66469Z"}],"osv":[{"id":"CVE-2026-47842","title":"Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation","description":"Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25","status":"published","published":"2026-08-26T19:22:23.745Z","modified":"2026-10-28T02:30:53.779109336Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"CLSA-2026-1792063694","title":"TuxCare security update for org.springframework.security (4 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 4 CVEs. Fixed in 6.4.3-tuxcare.10.","status":"published","published":"2026-10-15T11:28:14Z","modified":"2026-11-02T19:46:28.434183651Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792068377","title":"TuxCare security update for org.springframework.security (5 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 5 CVEs. Fixed in 6.4.13-tuxcare.6.","status":"published","published":"2026-10-15T12:46:17Z","modified":"2026-11-02T19:46:28.490077898Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792072377","title":"TuxCare security update for org.springframework.security (4 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 4 CVEs. Fixed in 6.5.11-tuxcare.3.","status":"published","published":"2026-10-15T13:52:57Z","modified":"2026-11-02T19:46:28.432973088Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792073875","title":"TuxCare security update for org.springframework.security (2 CVEs)","description":"TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 6.3.10-tuxcare.20.","status":"published","published":"2026-10-15T14:17:55Z","modified":"2026-11-02T19:46:28.509517384Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792077066","title":"TuxCare security update for org.springframework.security (8 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 8 CVEs. Fixed in 6.0.8-tuxcare.4.","status":"published","published":"2026-10-15T15:11:06Z","modified":"2026-11-02T19:46:28.9424175Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792077163","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.2.2-tuxcare.8.","status":"published","published":"2026-10-15T15:12:43Z","modified":"2026-11-02T19:46:28.623455684Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792077209","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.2.7-tuxcare.7.","status":"published","published":"2026-10-15T15:13:29Z","modified":"2026-11-02T19:46:28.620433693Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792077256","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.3.9-tuxcare.2.","status":"published","published":"2026-10-15T15:14:16Z","modified":"2026-11-02T19:46:28.579558243Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792077565","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.2.8-tuxcare.5.","status":"published","published":"2026-10-15T15:19:25Z","modified":"2026-11-02T19:46:28.960783721Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792079338","title":"TuxCare security update for org.springframework.security (2 CVEs)","description":"TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 5.8.16-tuxcare.16.","status":"published","published":"2026-10-15T15:48:58Z","modified":"2026-11-02T19:46:28.628161654Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792079446","title":"TuxCare security update for org.springframework.security (15 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 15 CVEs. Fixed in 6.0.7-tuxcare.1.","status":"published","published":"2026-10-15T15:50:46Z","modified":"2026-11-02T19:46:28.625713718Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792079757","title":"TuxCare security update for org.springframework.security (6 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 6 CVEs. Fixed in 6.1.6-tuxcare.8.","status":"published","published":"2026-10-15T15:55:57Z","modified":"2026-11-02T19:46:28.788534029Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792080021","title":"TuxCare security update for org.springframework.security (2 CVEs)","description":"TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 5.8.14-tuxcare.3.","status":"published","published":"2026-10-15T16:00:21Z","modified":"2026-11-02T19:46:29.20204437Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792084952","title":"TuxCare security update for org.springframework.security (11 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 11 CVEs. Fixed in 5.8.15-tuxcare.2.","status":"published","published":"2026-10-15T17:22:32Z","modified":"2026-11-02T19:46:29.285657098Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792085061","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 5.7.14-tuxcare.8.","status":"published","published":"2026-10-15T17:24:21Z","modified":"2026-11-02T19:46:29.375205234Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792089227","title":"TuxCare security update for org.springframework.security (10 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 10 CVEs. Fixed in 5.6.7-tuxcare.1.","status":"published","published":"2026-10-15T18:33:47Z","modified":"2026-11-02T19:46:29.416522144Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792089645","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 5.7.7-tuxcare.2.","status":"published","published":"2026-10-15T18:40:45Z","modified":"2026-11-02T19:46:29.390355178Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792099468","title":"TuxCare security update for org.springframework.security (2 CVEs)","description":"TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 5.7.12-tuxcare.11.","status":"published","published":"2026-10-15T21:24:28Z","modified":"2026-11-02T19:46:29.452373192Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792099521","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 5.6.9-tuxcare.2.","status":"published","published":"2026-10-15T21:25:21Z","modified":"2026-11-02T19:46:29.454294553Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792099598","title":"TuxCare security update for org.springframework.security (4 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 4 CVEs. Fixed in 5.6.10-tuxcare.8.","status":"published","published":"2026-10-15T21:26:38Z","modified":"2026-11-02T19:46:29.49264102Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792099763","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 5.5.8-tuxcare.2.","status":"published","published":"2026-10-15T21:29:23Z","modified":"2026-11-02T19:46:29.493416528Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792099789","title":"TuxCare security update for org.springframework.security (2 CVEs)","description":"TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 5.7.11-tuxcare.10.","status":"published","published":"2026-10-15T21:29:49Z","modified":"2026-11-02T19:46:29.441990695Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792102802","title":"TuxCare security update for org.springframework.security (8 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 8 CVEs. Fixed in 5.1.5.RELEASE-tuxcare.1.","status":"published","published":"2026-10-15T22:20:02Z","modified":"2026-11-02T19:46:29.511023688Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792502421","title":"TuxCare security update for org.springframework.security (6 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 6 CVEs. Fixed in 5.1.4.RELEASE-tuxcare.1.","status":"published","published":"2026-10-20T13:20:21Z","modified":"2026-11-02T19:46:29.604257702Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792503291","title":"TuxCare security update for org.springframework.security (9 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 9 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.1.","status":"published","published":"2026-10-20T13:34:51Z","modified":"2026-11-02T19:46:29.887116039Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1794175722","title":"TuxCare security update for org.springframework.security (14 CVEs)","description":"TuxCare rebuilt 6 org.springframework.security packages to address 14 CVEs. Fixed in 5.6.5-tuxcare.2.","status":"published","published":"2026-11-08T23:08:43Z","modified":"2026-11-09T01:45:02.285308078Z","updated_at":"2026-11-09T02:15:19.582074Z"},{"id":"CLSA-2026-1794189026","title":"TuxCare security update for org.springframework.security (14 CVEs)","description":"TuxCare rebuilt 6 org.springframework.security packages to address 14 CVEs. Fixed in 5.7.6-tuxcare.2.","status":"published","published":"2026-11-09T02:50:27Z","modified":"2026-11-09T07:15:04.238231713Z","updated_at":"2026-11-09T07:20:29.20536Z"},{"id":"CLSA-2026-1794189800","title":"TuxCare security update for org.springframework.security (14 CVEs)","description":"TuxCare rebuilt 7 org.springframework.security packages to address 14 CVEs. Fixed in 6.1.5-tuxcare.3.","status":"published","published":"2026-11-09T03:03:20Z","modified":"2026-11-09T07:15:04.228555714Z","updated_at":"2026-11-09T07:20:29.20536Z"},{"id":"CLSA-2026-1794244725","title":"TuxCare security update for org.springframework.security (13 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 13 CVEs. Fixed in 5.5.7-tuxcare.2.","status":"published","published":"2026-11-09T18:18:46Z","modified":"2026-11-10T01:15:02.463817981Z","updated_at":"2026-11-10T01:43:20.132342Z"},{"id":"CLSA-2026-1794245422","title":"TuxCare security update for org.springframework.security (13 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 13 CVEs. Fixed in 5.6.3-tuxcare.3.","status":"published","published":"2026-11-09T18:30:22Z","modified":"2026-11-10T01:15:02.483548797Z","updated_at":"2026-11-10T01:43:20.132342Z"},{"id":"CLSA-2026-1794246204","title":"TuxCare security update for org.springframework.security (8 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 8 CVEs. Fixed in 5.1.2.RELEASE-tuxcare.2.","status":"published","published":"2026-11-09T18:43:25Z","modified":"2026-11-10T01:15:04.343622113Z","updated_at":"2026-11-10T01:43:20.132342Z"}]}}