{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:be47689e-67d4-55d7-9166-60766726053b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-config",
      "purl": "pkg:maven/org.springframework.security/spring-security-config@6.5.11-tuxcare.3",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-config@6.5.11-tuxcare.3",
      "version": "6.5.11-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-config",
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.5.11",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.5.11"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-34034",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.5.11-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:38202e3c-bcf6-53d6-9e0a-74a5f637c1df",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34034 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-config. CVE-2023-34034 describes a pattern matching mismatch vulnerability in Spring Security WebFlux where using \"**\" as a pattern creates inconsistent interpretation between Spring Security and Spring WebFlux, potentially allowing security bypass. The fix normalizes pattern strings using initFullPathPattern() before parsing. The target repository (Spring Security 6.5.11) already contains the complete fix in all affected files. This fix was authored by upstream Spring Security developer Marcus Da Coregio and shipped with the upstream 6.5.11 release before TuxCare onboarded the version. The vulnerable pattern (missing initFullPathPattern() calls) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 6.1.0, <= 6.1.1; >= 6.0.0, <= 6.0.4; >= 5.8.0, <= 5.8.4; >= 5.7.0, <= 5.7.9; >= 5.6.0, <= 5.6.11), Snyk (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-34035",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.5.11-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:aec014fc-2c6a-5b12-8deb-0c67a5e32c78",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34035 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-config. CVE-2023-34035 is NOT present in Spring Security 6.5.11. The vulnerability concerns authorization rule misconfiguration when using requestMatchers(String) with multiple servlets. The upstream Spring Security project fixed this in commit df239b6448 (July 2023), which introduced validation to detect ambiguous servlet configurations and force explicit matcher type selection. A more sophisticated deferred validation approach was later introduced in commit 4ca54683ae (November 2023). Both fixes were included in the upstream Spring Security 6.5.11 release that TuxCare onboarded, meaning the vulnerable pattern was never present in this target version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 5.8.0, <= 5.8.4; >= 6.0.0, <= 6.0.4; >= 6.1.0, <= 6.1.1), Snyk (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-34042",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.5.11-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:dc1ac0c8-e2e8-5ded-a480-059d4fdc1751",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34042 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-config. not_affected \u2014 The target repository (Spring Security 6.5.11) is not affected by CVE-2023-34042. The vulnerability involved a world-writable spring-security.xsd file created from a symlink in the source tree. Upstream Spring Security fixed this in commit 5b293d2116 (September 2023) by removing the symlink and implementing build-time XSD generation with proper file permissions. This fix was already present in ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-22223",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.5.11-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:2a168098-a1b2-5931-94f9-de45a2900733",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-22223 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 6.5.11-tuxcare.4 is NOT AFFECTED by CVE-2025-22223. The vulnerability (method security annotations not being located on parameterized types/methods) was fixed by upstream Spring Security in commit dc2e1af2dab8ef81cd4edd25b56a2babeaab8cf9 (authored by Josh Cummings on 2025-01-08). This fix was already included in the upstream Spring Security 6.5.11 release that TuxCare onboarded ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22753",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.5.11-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:ef16263f-50c5-533f-bcb3-d0a41551146c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22753 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-config. not_affected \u2014 Version 6.5.11 is not affected by CVE-2026-22753. The vulnerability exists in specific code paths and classes introduced in Spring Security 7.0.x that do not exist in version 6.5.11. Version 6.5.11 uses a different, working architecture (RequestMatcherFactory) for retrieving custom PathPatternRequestMatcher.Builder beans, and the buggy classes from the 7.0.x patches (PathPatternRequestMatcherFa...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22754",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.5.11-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:d8abdc1b-a50e-5129-afa5-eefb8b3d9bfb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22754 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-config. not_affected \u2014 Version 6.5.11 is not affected by CVE-2026-22754. The vulnerability is specific to Spring Security 7.0.0-7.0.4 where PathPatternRequestMatcher became the default for XML configuration. Version 6.5.11 uses MvcRequestMatcher for servlet-path handling, which has a fundamentally different architecture and does not exhibit the vulnerable pattern.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-config@6.5.11-tuxcare.3"
    }
  ]
}