{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b89e3015-e23e-5c38-9684-83db99fd0bde",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-config",
      "purl": "pkg:maven/org.springframework.security/spring-security-config@5.6.9-tuxcare.5",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-config@5.6.9-tuxcare.5",
      "version": "5.6.9-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-config",
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.6.9",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.6.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-34034",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.6.9-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:953c9f95-a52d-5735-a989-4f0bbe16f9b2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-34034 affects version 5.6.9-tuxcare.5 of org.springframework.security:spring-security-config."
      }
    },
    {
      "id": "CVE-2023-34035",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.6.9-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:931d68bf-a448-5c95-aa67-092accc30ed9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-34035 affects version 5.6.9-tuxcare.5 of org.springframework.security:spring-security-config."
      }
    },
    {
      "id": "CVE-2023-34042",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.6.9-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:8aedc339-f97b-5945-9888-b037a5a02041",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34042 does not affect version 5.6.9-tuxcare.5 of org.springframework.security:spring-security-config. not_affected \u2014 Version 5.6.9 is not affected by CVE-2023-34042. The vulnerability was caused by a symlink file (spring-security.xsd \u2192 spring-security-5.7.xsd) that resulted in world-writable file permissions in the JAR. This symlink was introduced in commit 1eefd433b6 (May 2023), after version 5.6.9 was released. Version 5.6.9 predates the introduction of the symlink and only contains versioned XSD files (spr...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-22223",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.6.9-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:b5870f69-0b32-5e77-934d-706769c4c1fd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-22223 does not affect version 5.6.9-tuxcare.5 of org.springframework.security:spring-security-config. Prechecker: no vulnerable code from the patch was found, and this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Advisories: GitHub, cve.org (VMware) and Snyk list only 6.4.0 to 6.4.3 as affected, so this version is older than the affected range; NVD gives no range. Confirmed not affected by the Java ELS team review on 2026-11-06.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22753",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.6.9-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:4d29f133-8842-5866-a0c8-f8576eeb911b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22753 does not affect version 5.6.9-tuxcare.5 of org.springframework.security:spring-security-config. Spring Security 5.6.9 is not affected by CVE-2026-22753. The vulnerability requires two components that were introduced AFTER version 5.6.9: (1) the securityMatchers(String) API (added in 5.8.0, September 2022), and (2) PathPatternRequestMatcher.Builder (added in 6.5.x, March 2025). Version 5.6.9 uses an explicit servlet path API (.servletPath() on MvcRequestMatcher) with no automatic bean discovery or builder pattern for request matchers. The vulnerable code pattern cannot manifest in this architecture.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22754",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.6.9-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:60994380-64c5-57b5-b12b-dd6e9b5b06bb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22754 does not affect version 5.6.9-tuxcare.5 of org.springframework.security:spring-security-config. CVE-2026-22754 affects Spring Security 7.0.0-7.0.4, which introduced PathPatternRequestMatcherFactoryBean with a builder pattern bug where basePath() return value is discarded. Target version 5.6.9 uses a completely different architecture (MvcRequestMatcher with property setters) that correctly enforces servlet-path authorization rules. The vulnerable code path does not exist in this version.",
        "justification": "code_not_reachable"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-config@5.6.9-tuxcare.5"
    }
  ]
}