{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ab37c1f5-4ec0-5e73-9fd2-28141f203f93",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-config",
      "purl": "pkg:maven/org.springframework.security/spring-security-config@6.4.13-tuxcare.6",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-config@6.4.13-tuxcare.6",
      "version": "6.4.13-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-config",
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.4.13",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.4.13"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-34034",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.4.13-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:3494c816-dc50-54e8-a122-5c5c6102e57e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34034 does not affect version 6.4.13-tuxcare.6 of org.springframework.security:spring-security-config. CVE-2023-34034 affects Spring Security WebFlux pattern matching. The vulnerability occurs when path patterns (like \"**\") are used in security configuration without proper normalization via initFullPathPattern(), creating a mismatch between Spring Security's authorization checks and Spring WebFlux's routing decisions, potentially allowing security bypass. The fix (commit 7813a9ba) adds calls to parser.initFullPathPattern(pattern) before parsing in all affected components. This fix is already present in the target repository (Spring Security 6.4.13-tuxcare) as it was included in the upstream Spring Security 6.4.13 release before TuxCare onboarded this version. The fix was authored by Marcus Da Coregio, an upstream Spring Security maintainer, and shipped in upstream versions 5.6.12, 5.7.10, 5.8.5, 6.0.5, 6.1.2, and later. Target verdict: not_affected (upstream fix already present).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 6.1.0, <= 6.1.1; >= 6.0.0, <= 6.0.4; >= 5.8.0, <= 5.8.4; >= 5.7.0, <= 5.7.9; >= 5.6.0, <= 5.6.11), Snyk (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-34035",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.4.13-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:355fe02f-058a-5a82-8277-a8c2898ce114",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34035 does not affect version 6.4.13-tuxcare.6 of org.springframework.security:spring-security-config. The target repository (Spring Security 6.4.13-tuxcare.7) is NOT affected by CVE-2023-34035. The vulnerability, which caused authorization rule misconfiguration when using requestMatchers(String) in multi-servlet applications, was fixed in the upstream release that TuxCare onboarded. The fix commits (df239b6448 and subsequent improvements) were authored by upstream Spring Security maintainers and were already present in version 6.4.13 before TuxCare's Extended Lifecycle Support began. The current code implements a sophisticated runtime-delegation approach using DeferredRequestMatcher that correctly applies MVC matchers for DispatcherServlet requests and Ant matchers for other servlet requests, preventing the authorization misconfiguration described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 5.8.0, <= 5.8.4; >= 6.0.0, <= 6.0.4; >= 6.1.0, <= 6.1.1), Snyk (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-34042",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.4.13-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:78bd79b6-397b-5ea8-a4e2-49ccc0b51ba9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34042 does not affect version 6.4.13-tuxcare.6 of org.springframework.security:spring-security-config. not_affected \u2014 CVE-2023-34042 concerns a world-writable spring-security.xsd file due to a symlink (mode 120000) in source control that resulted in incorrect permissions when packaged into the JAR and extracted. The upstream Spring Security project fixed this in commit 5b293d2116 by removing the symlink and generating the file at build time with proper permissions. This fix was already included in Spring Secur...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-22223",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.4.13-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:e8bec036-214f-532c-806a-1efae058912a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-22223 does not affect version 6.4.13-tuxcare.6 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 6.4.13 is not affected by CVE-2025-22223. The vulnerability (incorrect annotation location on parameterized types causing authorization bypass) was fixed in upstream commit dc2e1af2da by Josh Cummings on 2025-01-08. This fix shipped in the upstream 6.4.13 release that TuxCare onboarded on 2026-07-17. The target contains the complete fix at lines 215-261 of UniqueSecurityAnnotati...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22753",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.4.13-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:c85fe587-835b-5490-bfb1-8214d4983d02",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22753 does not affect version 6.4.13-tuxcare.6 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 6.4.13 is not affected by CVE-2026-22753. This vulnerability is specific to the PathPatternRequestMatcher.Builder bean feature introduced in Spring Security 7.0.0. Version 6.4.13 uses a different architecture (MvcRequestMatcher with automatic servlet path detection) that does not have this vulnerability.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22754",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.4.13-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:87537c12-8558-519c-b886-1fbd58714f07",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22754 does not affect version 6.4.13-tuxcare.6 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 6.4.13 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a bug in PathPatternRequestMatcherFactoryBean where the builder's basePath() method is called without capturing its return value. Version 6.4.13 does not contain PathPatternRequestMatcher or PathPatternRequestMatcherFactoryBean classes. Instead, it uses the older MvcRequestMa...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-config@6.4.13-tuxcare.6"
    }
  ]
}