{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:13c1ef21-c6e1-5afb-8f25-3c14b578d7f2",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-config",
      "purl": "pkg:maven/org.springframework.security/spring-security-config@5.6.3-tuxcare.2",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-config@5.6.3-tuxcare.2",
      "version": "5.6.3-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-config",
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.6.3",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.6.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-34034",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.6.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cee7a9d2-c94d-51c2-aba3-f004dd1b5a14",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-34034 affects version 5.6.3-tuxcare.2 of org.springframework.security:spring-security-config."
      }
    },
    {
      "id": "CVE-2023-34035",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.6.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:bd11a389-060d-531e-8a5c-32cb8df69307",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-34035 affects version 5.6.3-tuxcare.2 of org.springframework.security:spring-security-config."
      }
    },
    {
      "id": "CVE-2023-34042",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.6.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ac19a511-d128-5755-b244-3f3c8c477a14",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34042 does not affect version 5.6.3-tuxcare.2 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 5.6.3 is not affected by CVE-2023-34042. The vulnerable spring-security.xsd symlink was introduced in version 5.7.x (May 19, 2023), over one year after version 5.6.3 was released (April 18, 2022). Version 5.6.3 does not contain a physical spring-security.xsd file; it only has a spring.schemas mapping that redirects to the properly-permissioned spring-security-5.6.xsd file. The v...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-22223",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.6.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ad14b94f-d785-5394-a395-e6f8dd2d0ad7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-22223 does not affect version 5.6.3-tuxcare.2 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 5.6.3 is not affected by CVE-2025-22223. The vulnerable class UniqueSecurityAnnotationScanner was introduced in version 6.4.0 (August 2024), significantly later than this 5.6.3 release (March 2022). Version 5.6.3 uses a different annotation scanning architecture (PrePostAnnotationSecurityMetadataSource and AuthorizationAnnotationUtils) that correctly handles method security anno...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22753",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.6.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:28048d3b-6381-5d92-9b06-d8f7f4702bb4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22753 does not affect version 5.6.3-tuxcare.2 of org.springframework.security:spring-security-config. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.6.3 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4wrg-8wpc-h923 (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22754",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.6.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1bfe0cde-71a3-5bc3-820b-2018fb53dada",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22754 does not affect version 5.6.3-tuxcare.2 of org.springframework.security:spring-security-config. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.6.3 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4vrc-j85c-598c (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-config@5.6.3-tuxcare.2"
    }
  ]
}