{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:2e82e620-9997-51b3-8fda-27668a65a739",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-config",
      "purl": "pkg:maven/org.springframework.security/spring-security-config@3.2.8.RELEASE-tuxcare.2",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-config@3.2.8.RELEASE-tuxcare.2",
      "version": "3.2.8.RELEASE-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-config",
            "purl": "pkg:maven/org.springframework.security/spring-security-config@3.2.8.RELEASE",
            "type": "library",
            "group": "org.springframework.security",
            "version": "3.2.8.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-34034",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@3.2.8.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e67a349c-ae42-53e6-b872-89f9e2421823",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-34034 affects version 3.2.8.RELEASE-tuxcare.2 of org.springframework.security:spring-security-config."
      }
    },
    {
      "id": "CVE-2023-34035",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@3.2.8.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0f9cb7a6-2299-5c28-be0f-a48d705418fd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-34035 affects version 3.2.8.RELEASE-tuxcare.2 of org.springframework.security:spring-security-config."
      }
    },
    {
      "id": "CVE-2023-34042",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@3.2.8.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c23d7ed1-5823-57b1-9205-7802c6bd3a00",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34042 does not affect version 3.2.8.RELEASE-tuxcare.2 of org.springframework.security:spring-security-config. not_affected \u2014 Version 3.2.8.RELEASE is not affected by CVE-2023-34042. The vulnerability concerns a world-writable symlink file (spring-security.xsd) that was introduced in May 2023, eight years AFTER version 3.2.8.RELEASE was released (July 2015). The target version uses a different architectural approach with only versioned XSD files (spring-security-3.2.xsd, etc.) as regular files with correct permissions...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-22223",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@3.2.8.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6d98721f-e98e-5ab4-9e8e-e07ba78204c5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-22223 does not affect version 3.2.8.RELEASE-tuxcare.2 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 3.2.8.RELEASE is not affected by CVE-2025-22223. The vulnerability targets the modern method security architecture (`@EnableMethodSecurity` + `UniqueSecurityAnnotationScanner`) introduced in Spring Security 5.6+. Spring Security 3.2.8 uses a fundamentally different architecture (`@EnableGlobalMethodSecurity` + `PrePostAnnotationSecurityMetadataSource`) and lacks both the vulnera...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22753",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@3.2.8.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:86ae9749-abb7-59fb-bdcb-58e424366f6e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22753 does not affect version 3.2.8.RELEASE-tuxcare.2 of org.springframework.security:spring-security-config. Spring Security 3.2.8.RELEASE is not affected by CVE-2026-22753. The vulnerability requires PathPatternRequestMatcher infrastructure (PathPatternRequestMatcher class, PathPatternRequestMatcher.Builder, PathPatternRequestMatcherFactoryBean, HttpSecurityConfiguration) that was introduced in Spring Framework 5.3+ and Spring Security 5.5+. Version 3.2.8.RELEASE (released 2014) uses a completely different request matching architecture based on AntPathRequestMatcher and RegexRequestMatcher, which does not have the bean lookup bug or builder assignment bug that the patches fix. The vulnerable code patterns do not exist in this version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22754",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@3.2.8.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:37a342dd-ff93-5961-9512-721e8fd1aa25",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22754 does not affect version 3.2.8.RELEASE-tuxcare.2 of org.springframework.security:spring-security-config. Spring Security 3.2.8.RELEASE is not affected by CVE-2026-22754. The vulnerability exists in the servlet-path attribute feature for intercept-url elements, which was introduced in Spring Security 7.0.0. Version 3.2.8 uses a completely different architecture (AntPathRequestMatcher/RegexRequestMatcher) that reads servlet paths from HTTP requests rather than configuration. The servlet-path attribute does not exist in the 3.2.8 XSD schema, and the vulnerable classes (PathPatternRequestMatcherFactoryBean, HttpSecurityConfiguration with PathPatternRequestMatcher.Builder) do not exist in this version.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-config@3.2.8.RELEASE-tuxcare.2"
    }
  ]
}