{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:db93a68b-478d-50bf-9799-b86d08336c4e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-config",
      "purl": "pkg:maven/org.springframework.security/spring-security-config@5.5.7-tuxcare.1",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.7-tuxcare.1",
      "version": "5.5.7-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-config",
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.5.7",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.5.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-34034",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.7-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dd305930-cb81-542d-aeb6-118af94f6fb9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-34034 affects version 5.5.7-tuxcare.1 of org.springframework.security:spring-security-config."
      }
    },
    {
      "id": "CVE-2023-34035",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.7-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6d374b30-819f-502f-b6c6-66094ee8f081",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-34035 affects version 5.5.7-tuxcare.1 of org.springframework.security:spring-security-config."
      }
    },
    {
      "id": "CVE-2023-34042",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.7-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:28a5593e-cf87-596f-9041-e47f386fe2fb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-34042 affects version 5.5.7-tuxcare.1 of org.springframework.security:spring-security-config."
      }
    },
    {
      "id": "CVE-2025-22223",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.7-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8d261f8f-a1ae-5556-9cd1-d426ed2f9954",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-22223 does not affect version 5.5.7-tuxcare.1 of org.springframework.security:spring-security-config. not_affected \u2014 Not affected. CVE-2025-22223 affects the AuthorizationManager-based method security that @EnableMethodSecurity enables (Spring Security 5.7+/6.x). That code does not exist in 5.5.7. This target only has the legacy @EnableGlobalMethodSecurity and MethodSecurityMetadataSource path. That path finds annotations through Spring Framework 5.3.20's AnnotationUtils.findAnnotation, a different code path ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22753",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.7-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a125998f-738a-5f54-a3d6-87588a96512c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22753 does not affect version 5.5.7-tuxcare.1 of org.springframework.security:spring-security-config. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.5.7 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4wrg-8wpc-h923 (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22754",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.7-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0e24c352-de40-5a88-8c07-5fdf75445b29",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22754 does not affect version 5.5.7-tuxcare.1 of org.springframework.security:spring-security-config. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.5.7 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4vrc-j85c-598c (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-config@5.5.7-tuxcare.1"
    }
  ]
}