{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:00bffa46-7086-5082-a1ab-e95e599fee5c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-config",
      "purl": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1",
      "version": "5.1.6.RELEASE-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-config",
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.1.6.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-34034",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2c02d284-48b2-5dbd-8ef4-368b001f21a4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-34034 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config."
      }
    },
    {
      "id": "CVE-2023-34035",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b72bc58a-41e8-5a5f-9ce3-7df21a892c41",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-34035 affects version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config."
      }
    },
    {
      "id": "CVE-2023-34042",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:492dd69d-f306-5dbd-99da-e560acc4094d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34042 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. not_affected \u2014 Version 5.1.6.RELEASE is NOT AFFECTED by CVE-2023-34042. The vulnerability involves a world-writable spring-security.xsd file caused by a symlink in the source tree. However, this symlink was introduced on 2023-05-19 in versions 5.7.9 and later, and never existed in version 5.1.6.RELEASE. The problematic file spring-security.xsd does not exist in the target repository at all. All XSD files pres...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-22223",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ce44a952-d21c-54f3-8976-0699caa364f4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-22223 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 5.1.6.RELEASE does not contain the vulnerable code. CVE-2025-22223 specifically affects applications using @EnableMethodSecurity (introduced in Spring Security 5.6+), which resolves method security annotations via UniqueSecurityAnnotationScanner. Version 5.1.6 uses the older @EnableGlobalMethodSecurity API with PrePostAnnotationSecurityMetadataSource, a completely different impl...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22753",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2f0c7ea9-ad3e-57ad-8f64-ad1c96f8f4fb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22753 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. Spring Security 5.1.6.RELEASE is not affected by CVE-2026-22753. The vulnerability affects versions 7.0.0-7.0.4 and involves PathPatternRequestMatcher.Builder bean discovery and basePath assignment failures. Version 5.1.6 predates the PathPatternRequestMatcher architecture entirely - it uses the older AntPathMatcher-based request matching via MvcRequestMatcher with direct servlet path setters, not the builder pattern introduced in 7.x. The vulnerable code pattern does not exist in this version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22754",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:deaaeac8-ae75-50da-aba9-4b2d2513f4a5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22754 does not affect version 5.1.6.RELEASE-tuxcare.1 of org.springframework.security:spring-security-config. Spring Security 5.1.6.RELEASE is not affected by CVE-2026-22754. The vulnerability is architecture-specific to version 7.0.0-7.0.4's PathPatternRequestMatcherFactoryBean, which uses an immutable builder pattern where the basePath() return value was not captured, causing servlet-path authorization rules to be silently ignored. Version 5.1.6 uses a completely different implementation (MvcRequestMatcher) with direct property setting via setServletPath() - no builder pattern exists. The servletPath property is correctly set during bean construction (via BeanDefinitionBuilder.addPropertyValue for XML config or direct setter calls for Java config) and is properly checked at runtime in MvcRequestMatcher.matches() lines 67-70, blocking requests that don't match the configured servlet path. Tests confirm servlet-path authorization works correctly in 5.1.6. This is Rule 5 Type B: alternative defense present at runtime.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-config@5.1.6.RELEASE-tuxcare.1"
    }
  ]
}