{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8903b462-de57-5e61-95f4-a9ba431b342f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-config",
      "purl": "pkg:maven/org.springframework.security/spring-security-config@6.1.5-tuxcare.3",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-config@6.1.5-tuxcare.3",
      "version": "6.1.5-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-config",
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.1.5",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.1.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-34034",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.1.5-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:0d3db8fc-6080-57d7-9cb0-1e4200ec2f15",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34034 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-config. The target Spring Security 6.1.5-tuxcare.2 is NOT AFFECTED by CVE-2023-34034. The upstream fix (commit 7813a9ba26) that addresses the \"**\" pattern matching mismatch vulnerability was already present in the upstream Spring Security 6.1.5 release when TuxCare onboarded it. The fix ensures consistent path pattern parsing between Spring Security and Spring WebFlux by using PathPatternParser.defaultInstance and calling initFullPathPattern() before parsing patterns, eliminating the security bypass risk.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 6.1.0, <= 6.1.1; >= 6.0.0, <= 6.0.4; >= 5.8.0, <= 5.8.4; >= 5.7.0, <= 5.7.9; >= 5.6.0, <= 5.6.11), Snyk (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-34035",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.1.5-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:9f9c35af-ea77-5148-9e1e-3757d7441ff3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34035 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-config. The target repository (Spring Security 6.1.5-tuxcare.2) is NOT affected by CVE-2023-34035. The vulnerability pattern has been removed by an upstream fix that was already present in version 6.1.5 when TuxCare onboarded it. The CVE affects Spring Security 6.1 prior to 6.1.2, and this target is version 6.1.5. The fix commit (df239b6448) introduced validation logic that throws an exception when requestMatchers(String) is used ambiguously with multiple servlets, preventing the authorization misconfiguration that could lead to security bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 5.8.0, <= 5.8.4; >= 6.0.0, <= 6.0.4; >= 6.1.0, <= 6.1.1), Snyk (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-34042",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.1.5-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:ec0545ac-392f-5ab8-baff-817fa3d4c64c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34042 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-config. not_affected \u2014 CVE-2023-34042 is NOT present in Spring Security 6.1.5-tuxcare.2. The vulnerability involved a world-writable symbolic link (spring-security.xsd) that was packaged into the spring-security-config JAR with incorrect permissions (CWE-732). The upstream fix (commit 5b293d2116 by Rob Winch, September 2023) removed the symlink entirely and replaced it with a build-time task that generates the file b...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-22223",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.1.5-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:9894e408-8255-5237-bc06-316655aa61c3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22223 is fixed in version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-config."
      }
    },
    {
      "id": "CVE-2026-22753",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.1.5-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:39c5f9db-f437-5d34-88a0-b82344dfad49",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22753 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-config. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 6.1.5 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4wrg-8wpc-h923 (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22754",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.1.5-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:1bae4db9-c88a-557a-bb97-261c811b5e30",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22754 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-config. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 6.1.5 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4vrc-j85c-598c (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-config@6.1.5-tuxcare.3"
    }
  ]
}