{
  "@id": "urn:uuid:07419230-e1b4-4653-89ed-4d099082bdeb",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T15:05:07.257149+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2023-34034 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-config. The target Spring Security 6.2.8 is NOT AFFECTED by CVE-2023-34034. The vulnerability pattern (inconsistent PathPatternParser usage causing pattern matching mismatch between Spring Security and Spring WebFlux) is not present because the fix was already included in the upstream Spring Security 6.2.0 release (November 2023), which predates the TuxCare onboarding of version 6.2.8. All three affected files contain the defense code that ensures path patterns are initialized via initFullPathPattern() using PathPatternParser.defaultInstance, eliminating the mismatch that enabled security bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 6.1.0, <= 6.1.1; >= 6.0.0, <= 6.0.4; >= 5.8.0, <= 5.8.4; >= 5.7.0, <= 5.7.9; >= 5.6.0, <= 5.6.11), Snyk (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34034"
      },
      "impact_statement": "The target Spring Security 6.2.8 is NOT AFFECTED by CVE-2023-34034. The vulnerability pattern (inconsistent PathPatternParser usage causing pattern matching mismatch between Spring Security and Spring WebFlux) is not present because the fix was already included in the upstream Spring Security 6.2.0 release (November 2023), which predates the TuxCare onboarding of version 6.2.8. All three affected files contain the defense code that ensures path patterns are initialized via initFullPathPattern() using PathPatternParser.defaultInstance, eliminating the mismatch that enabled security bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 6.1.0, <= 6.1.1; >= 6.0.0, <= 6.0.4; >= 5.8.0, <= 5.8.4; >= 5.7.0, <= 5.7.9; >= 5.6.0, <= 5.6.11), Snyk (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2023-34035 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-config. Spring Security 6.2.8-tuxcare.6 is NOT affected by CVE-2023-34035. The vulnerability affected versions prior to 5.8.5, 6.0.5, and 6.1.2. Version 6.2.8 shipped with a sophisticated upstream fix (commit 4ca54683ae by Josh Cummings, Nov 2023) that addresses the authorization rule misconfiguration issue via DeferredRequestMatcher. This fix defers servlet configuration validation to runtime, either throwing an exception for ambiguous configurations or using DispatcherServletDelegatingRequestMatcher to correctly route requests to appropriate matchers based on which servlet handles each request. The fix was already present in the upstream Spring Security 6.2.8 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 5.8.0, <= 5.8.4; >= 6.0.0, <= 6.0.4; >= 6.1.0, <= 6.1.1), Snyk (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34035"
      },
      "impact_statement": "Spring Security 6.2.8-tuxcare.6 is NOT affected by CVE-2023-34035. The vulnerability affected versions prior to 5.8.5, 6.0.5, and 6.1.2. Version 6.2.8 shipped with a sophisticated upstream fix (commit 4ca54683ae by Josh Cummings, Nov 2023) that addresses the authorization rule misconfiguration issue via DeferredRequestMatcher. This fix defers servlet configuration validation to runtime, either throwing an exception for ambiguous configurations or using DispatcherServletDelegatingRequestMatcher to correctly route requests to appropriate matchers based on which servlet handles each request. The fix was already present in the upstream Spring Security 6.2.8 release before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 5.8.0, <= 5.8.4; >= 6.0.0, <= 6.0.4; >= 6.1.0, <= 6.1.1), Snyk (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2023-34042 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-config. not_affected \u2014 CVE-2023-34042 concerns world-writable file permissions on spring-security.xsd when packaged in the JAR. The vulnerability existed when this file was a symlink in the source tree (symlinks can inherit incorrect permissions when packaged). The upstream Spring Security project fixed this in commit 5b293d21161e946bf241d9e974b9af93cfafaaac by removing the symlink and implementing build-time generat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34042"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-34042 concerns world-writable file permissions on spring-security.xsd when packaged in the JAR. The vulnerability existed when this file was a symlink in the source tree (symlinks can inherit incorrect permissions when packaged). The upstream Spring Security project fixed this in commit 5b293d21161e946bf241d9e974b9af93cfafaaac by removing the symlink and implementing build-time generat..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:05:07.257149+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 is fixed in version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-config.",
      "vulnerability": {
        "name": "CVE-2025-22223"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2026-22753 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2026-22753. The vulnerability is specific to PathPatternRequestMatcher.Builder functionality introduced in Spring Security 7.0.0. Version 6.2.8 uses a different request matching architecture (MvcRequestMatcher and AntPathRequestMatcher) that does not contain the vulnerable code pattern.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22753"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.2.8 is not affected by CVE-2026-22753. The vulnerability is specific to PathPatternRequestMatcher.Builder functionality introduced in Spring Security 7.0.0. Version 6.2.8 uses a different request matching architecture (MvcRequestMatcher and AntPathRequestMatcher) that does not contain the vulnerable code pattern."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.2.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:30.965794+00:00",
      "status_notes": "Vulnerability CVE-2026-22754 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-config. not_affected \u2014 Version 6.2.8 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean, a class that does not exist in version 6.2.8. Version 6.2.8 uses a completely different architecture (MvcRequestMatcher with property setters) that correctly handles servlet-path configuration without the builder reassignm...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-22754"
      },
      "impact_statement": "not_affected \u2014 Version 6.2.8 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean, a class that does not exist in version 6.2.8. Version 6.2.8 uses a completely different architecture (MvcRequestMatcher with property setters) that correctly handles servlet-path configuration without the builder reassignm..."
    }
  ]
}