{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:58cc2669-095d-5bec-8634-7e16d1161ab7",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-config",
      "purl": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.2",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.2",
      "version": "5.1.5.RELEASE-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-config",
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.1.5.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-34034",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fe1172be-25e0-51ca-ab16-0e0db14ec050",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-34034 affects version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-config."
      }
    },
    {
      "id": "CVE-2023-34035",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4068c122-ca04-5f4e-800b-5b7151947163",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-34035 affects version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-config."
      }
    },
    {
      "id": "CVE-2023-34042",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:805ddb9d-5599-51f4-8e3f-5420c776b459",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34042 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-config. not_affected \u2014 The target Spring Security version 5.1.5.RELEASE does not contain CVE-2023-34042's vulnerable pattern. The vulnerability concerns a symlink file (spring-security.xsd) with world-writable permissions in the JAR artifact. This symlink was introduced in Spring Security 5.7.9+ (commit 1eefd433b6, May 2023) and fixed in 5.7.11+/5.8.7+/6.0.7+/6.1.4+ (commit 5b293d2116, Sept 2023). The target version ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-22223",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1422673d-0dbb-5c9c-8dc9-9d67eac5075c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-22223 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 5.1.5.RELEASE is not affected by CVE-2025-22223. The vulnerability requires @EnableMethodSecurity and the UniqueSecurityAnnotationScanner class, both introduced in Spring Security 6.0.0. Version 5.1.5 uses @EnableGlobalMethodSecurity with PrePostAnnotationSecurityMetadataSource, which relies on Spring Framework's ClassUtils.getMostSpecificMethod() to correctly resolve annotation...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22753",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:356fb142-1b00-593d-98af-644d8f0bb352",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22753 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-config. Spring Security 5.1.5.RELEASE is not affected by CVE-2026-22753. The vulnerability requires PathPatternRequestMatcher.Builder, a class introduced in Spring Security 7.0+. Version 5.1.5 uses a completely different request matching architecture (MvcRequestMatcher, AntPathRequestMatcher, RegexRequestMatcher) where servlet paths are configured through direct method calls rather than bean configuration. The vulnerable code pattern cannot exist in this version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22754",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:11f1a92b-8fb4-5be8-b08a-3c24581762fd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22754 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-config. Spring Security 5.1.5.RELEASE is not affected by CVE-2026-22754. The vulnerability exists in version 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean where the basePath() return value is not captured, and HttpSecurityConfiguration doesn't use bean-provided builders. Version 5.1.5 uses a completely different architecture (MvcRequestMatcher with property setters instead of PathPatternRequestMatcher with builders), and the servlet-path feature has worked correctly since its introduction in Spring Security 4.1 (2016).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.5.RELEASE-tuxcare.2"
    }
  ]
}