{
  "@id": "urn:uuid:659f5f0f-8415-48d5-9f11-bb34a0c01415",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T01:39:48.171576+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.4.3-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.4.3-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-09T01:39:48.171576+00:00",
      "status_notes": "Vulnerability CVE-2023-34034 does not affect version 6.4.3-tuxcare.13 of org.springframework.security:spring-security-config. CVE-2023-34034 describes a pattern matching mismatch vulnerability in Spring Security WebFlux where \"**\" patterns are interpreted differently between Spring Security and Spring WebFlux, creating potential security bypasses. The vulnerability existed when PathPatternParser was instantiated separately rather than using the shared default instance and when initFullPathPattern() was not called before parsing. The target repository (Spring Security 6.4.3) already contains the upstream fix (commit 7813a9ba26) which was included in the original 6.4.3 release before TuxCare onboarding. All affected files show the fixed code using PathPatternParser.defaultInstance and calling initFullPathPattern() before parsing patterns.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 6.1.0, <= 6.1.1; >= 6.0.0, <= 6.0.4; >= 5.8.0, <= 5.8.4; >= 5.7.0, <= 5.7.9; >= 5.6.0, <= 5.6.11), Snyk (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34034"
      },
      "impact_statement": "CVE-2023-34034 describes a pattern matching mismatch vulnerability in Spring Security WebFlux where \"**\" patterns are interpreted differently between Spring Security and Spring WebFlux, creating potential security bypasses. The vulnerability existed when PathPatternParser was instantiated separately rather than using the shared default instance and when initFullPathPattern() was not called before parsing. The target repository (Spring Security 6.4.3) already contains the upstream fix (commit 7813a9ba26) which was included in the original 6.4.3 release before TuxCare onboarding. All affected files show the fixed code using PathPatternParser.defaultInstance and calling initFullPathPattern() before parsing patterns.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 6.1.0, <= 6.1.1; >= 6.0.0, <= 6.0.4; >= 5.8.0, <= 5.8.4; >= 5.7.0, <= 5.7.9; >= 5.6.0, <= 5.6.11), Snyk (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.4.3-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.4.3-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-09T01:39:48.171576+00:00",
      "status_notes": "Vulnerability CVE-2023-34035 does not affect version 6.4.3-tuxcare.13 of org.springframework.security:spring-security-config. CVE-2023-34035 is NOT present in Spring Security 6.4.3. The vulnerability was fixed upstream in version 6.1.2 (commit df239b6448), and the target version 6.4.3 contains an even more sophisticated evolution of that fix. The target implements runtime-deferred validation with the resolve() method that throws IllegalArgumentException when servlet configuration is ambiguous, preventing the authorization rule misconfiguration described in the CVE. This fix was authored by Josh Cummings (upstream Spring Security maintainer) and shipped in the upstream 6.4.3 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 5.8.0, <= 5.8.4; >= 6.0.0, <= 6.0.4; >= 6.1.0, <= 6.1.1), Snyk (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34035"
      },
      "impact_statement": "CVE-2023-34035 is NOT present in Spring Security 6.4.3. The vulnerability was fixed upstream in version 6.1.2 (commit df239b6448), and the target version 6.4.3 contains an even more sophisticated evolution of that fix. The target implements runtime-deferred validation with the resolve() method that throws IllegalArgumentException when servlet configuration is ambiguous, preventing the authorization rule misconfiguration described in the CVE. This fix was authored by Josh Cummings (upstream Spring Security maintainer) and shipped in the upstream 6.4.3 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 5.8.0, <= 5.8.4; >= 6.0.0, <= 6.0.4; >= 6.1.0, <= 6.1.1), Snyk (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.4.3-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.4.3-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-09T01:39:48.171576+00:00",
      "status_notes": "Vulnerability CVE-2023-34042 does not affect version 6.4.3-tuxcare.13 of org.springframework.security:spring-security-config. not_affected \u2014 CVE-2023-34042 concerns a symbolic link (spring-security.xsd) in the source tree that resulted in world-writable file permissions when packaged into the JAR (CWE-732). The upstream fix (commit 5b293d2116 by Rob Winch) removed the symbolic link and replaced it with an automated build task that generates the file as a proper copy with correct permissions. This fix was already present in the upstr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34042"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-34042 concerns a symbolic link (spring-security.xsd) in the source tree that resulted in world-writable file permissions when packaged into the JAR (CWE-732). The upstream fix (commit 5b293d2116 by Rob Winch) removed the symbolic link and replaced it with an automated build task that generates the file as a proper copy with correct permissions. This fix was already present in the upstr..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.4.3-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.4.3-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-09T01:39:48.171576+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 is fixed in version 6.4.3-tuxcare.13 of org.springframework.security:spring-security-config.",
      "vulnerability": {
        "name": "CVE-2025-22223"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.4.3-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.4.3-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-09T01:39:48.171576+00:00",
      "status_notes": "Vulnerability CVE-2026-22753 does not affect version 6.4.3-tuxcare.13 of org.springframework.security:spring-security-config. According to security advisories CVE-2026-22753 does not affect Spring-Security versions earlier than 7.0.0. This is supported by manual code inspection. CVE-2026-22753 is an access-control bypass that occurs when a user-registered PathPatternRequestMatcher.Builder bean (configured with a basePath/servlet path prefix) is silently ignored by the securityMatchers DSL, causing the security filter chain to match a different URL than the user configured. The vulnerability requires two pieces of infrastructure introduced in Spring Security 7.0.0: 1. The PathPatternRequestMatcher.Builder API itself (added in upstream commit aeb2dbc2 on 2025-08-18). 2. The wiring in HttpSecurityConfiguration.createSharedObjects() that registers this Builder as a shared object \u2014 the exact line patched by upstream commit 438c783c (the CVE fix). Neither piece exists in version 6.4.3.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22753"
      },
      "impact_statement": "According to security advisories CVE-2026-22753 does not affect Spring-Security versions earlier than 7.0.0. This is supported by manual code inspection. CVE-2026-22753 is an access-control bypass that occurs when a user-registered PathPatternRequestMatcher.Builder bean (configured with a basePath/servlet path prefix) is silently ignored by the securityMatchers DSL, causing the security filter chain to match a different URL than the user configured. The vulnerability requires two pieces of infrastructure introduced in Spring Security 7.0.0: 1. The PathPatternRequestMatcher.Builder API itself (added in upstream commit aeb2dbc2 on 2025-08-18). 2. The wiring in HttpSecurityConfiguration.createSharedObjects() that registers this Builder as a shared object \u2014 the exact line patched by upstream commit 438c783c (the CVE fix). Neither piece exists in version 6.4.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.4.3-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.4.3-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-09T01:39:48.171576+00:00",
      "status_notes": "Vulnerability CVE-2026-22754 does not affect version 6.4.3-tuxcare.13 of org.springframework.security:spring-security-config. According to security advisories CVE-2026-22754 does not affect Spring-Security versions earlier than 7.0.0. This is supported by manual code inspection and proof-of-concept tests ported from the upstream fix commit. CVE-2026-22754 is an access-control bypass caused by PathPatternRequestMatcherFactoryBean.afterPropertiesSet() calling this.builder.basePath(this.basePath) and discarding the return value \u2014 PathPatternRequestMatcher.Builder is immutable/copy-on-modify, so the configured basePath was silently dropped and protected URLs (e.g., /spring/path) were left unmatched by the security filter chain. The vulnerability requires two pieces of infrastructure introduced in Spring Security 7.0.0: 1. The PathPatternRequestMatcher.Builder API (added in upstream commit 3e53cc2c4a, \"Use PathPatternRequestMatcher in config\"). 2. The PathPatternRequestMatcherFactoryBean class itself \u2014 the exact file patched by upstream commit 53bcf0d1 (the CVE fix). Neither piece exists in version 6.4.3. The upstream POC tests (RegexMatcher, CiRegexMatcher + AuthorizationManager variants) were ported verbatim and pass.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22754"
      },
      "impact_statement": "According to security advisories CVE-2026-22754 does not affect Spring-Security versions earlier than 7.0.0. This is supported by manual code inspection and proof-of-concept tests ported from the upstream fix commit. CVE-2026-22754 is an access-control bypass caused by PathPatternRequestMatcherFactoryBean.afterPropertiesSet() calling this.builder.basePath(this.basePath) and discarding the return value \u2014 PathPatternRequestMatcher.Builder is immutable/copy-on-modify, so the configured basePath was silently dropped and protected URLs (e.g., /spring/path) were left unmatched by the security filter chain. The vulnerability requires two pieces of infrastructure introduced in Spring Security 7.0.0: 1. The PathPatternRequestMatcher.Builder API (added in upstream commit 3e53cc2c4a, \"Use PathPatternRequestMatcher in config\"). 2. The PathPatternRequestMatcherFactoryBean class itself \u2014 the exact file patched by upstream commit 53bcf0d1 (the CVE fix). Neither piece exists in version 6.4.3. The upstream POC tests (RegexMatcher, CiRegexMatcher + AuthorizationManager variants) were ported verbatim and pass."
    }
  ]
}