{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:26927b62-e5f9-5a62-abc4-a4c8588230e9",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-config",
      "purl": "pkg:maven/org.springframework.security/spring-security-config@5.7.6-tuxcare.3",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-config@5.7.6-tuxcare.3",
      "version": "5.7.6-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-config",
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.7.6",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.7.6"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-34034",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.7.6-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:d0c0f519-2dda-5a10-a5ce-b2e1a6cad021",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-34034 affects version 5.7.6-tuxcare.3 of org.springframework.security:spring-security-config."
      }
    },
    {
      "id": "CVE-2023-34035",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.7.6-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:ddf7e0bf-9e2d-5894-ae25-c416e122eed5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-34035 affects version 5.7.6-tuxcare.3 of org.springframework.security:spring-security-config."
      }
    },
    {
      "id": "CVE-2023-34042",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.7.6-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:4f88f896-048d-5a2d-9768-9d72a8b08192",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-34042 affects version 5.7.6-tuxcare.3 of org.springframework.security:spring-security-config."
      }
    },
    {
      "id": "CVE-2025-22223",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.7.6-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:1db6458d-3971-52a1-893b-428b870ef6f2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22223 is fixed in version 5.7.6-tuxcare.3 of org.springframework.security:spring-security-config."
      }
    },
    {
      "id": "CVE-2026-22753",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.7.6-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:9c696121-1544-5363-a2c8-44f464033762",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22753 does not affect version 5.7.6-tuxcare.3 of org.springframework.security:spring-security-config. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.7.6 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4wrg-8wpc-h923 (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22754",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@5.7.6-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:4745d96f-c69b-5873-bd4d-1ae2dc0593d2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22754 does not affect version 5.7.6-tuxcare.3 of org.springframework.security:spring-security-config. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.7.6 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4vrc-j85c-598c (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-config@5.7.6-tuxcare.3"
    }
  ]
}