{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:2daf4f81-568a-529c-8d7f-fb47493d8c4b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-config",
      "purl": "pkg:maven/org.springframework.security/spring-security-config@6.0.8-tuxcare.7",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-config@6.0.8-tuxcare.7",
      "version": "6.0.8-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-config",
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.0.8",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.0.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-34034",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.0.8-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:f3be90ab-2bc7-5aca-b1c4-4486fc4ddd03",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34034 does not affect version 6.0.8-tuxcare.7 of org.springframework.security:spring-security-config. CVE-2023-34034 is NOT present in Spring Security 6.0.8. The vulnerability concerns a pattern matching mismatch when using \"**\" and similar patterns in Spring Security WebFlux configuration. The upstream fix (commit 7813a9ba26 by Marcus Da Coregio, dated July 5, 2023) was already included in the Spring Security 6.0.8 release that TuxCare onboarded. The fix normalizes pattern parsing by calling initFullPathPattern() before parsing and using PathPatternParser.defaultInstance, eliminating the mismatch between Spring Security and Spring WebFlux pattern matching. All four affected source files contain the fixed code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 6.1.0, <= 6.1.1; >= 6.0.0, <= 6.0.4; >= 5.8.0, <= 5.8.4; >= 5.7.0, <= 5.7.9; >= 5.6.0, <= 5.6.11), Snyk (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-34035",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.0.8-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:93dc757d-713e-5611-9c44-288fc7fca3eb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34035 does not affect version 6.0.8-tuxcare.7 of org.springframework.security:spring-security-config. The target Spring Security 6.0.8-tuxcare.5 is NOT AFFECTED by CVE-2023-34035. The vulnerability affects versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2. The fix for this authorization rule misconfiguration vulnerability was implemented in commit df239b6448 by the upstream Spring Security team and was already present in the upstream 6.0.8 release that TuxCare onboarded. The defense mechanism (multi-servlet registration validation with exception throwing) is present in AbstractRequestMatcherRegistry.java at lines 187-211.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 5.8.0, <= 5.8.4; >= 6.0.0, <= 6.0.4; >= 6.1.0, <= 6.1.1), Snyk (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-34042",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.0.8-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:f2eabb2e-52f2-58c4-a727-f453a83041e0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34042 does not affect version 6.0.8-tuxcare.7 of org.springframework.security:spring-security-config. not_affected \u2014 CVE-2023-34042 is NOT present in the target. The upstream vendor fix (commit 5b293d21161e946bf241d9e974b9af93cfafaaac by Rob Winch) has already been applied to version 6.0.8. The vulnerable symlink at config/src/main/resources/org/springframework/security/config/spring-security.xsd has been removed, and the secure build-time file generation mechanism (CreateVersionlessXsdTask) is properly imple..."
      }
    },
    {
      "id": "CVE-2025-22223",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.0.8-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:fc06a027-85f0-56c0-8a6b-719c6066c7df",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22223 is fixed in version 6.0.8-tuxcare.7 of org.springframework.security:spring-security-config."
      }
    },
    {
      "id": "CVE-2026-22753",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.0.8-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:05469147-0493-540e-bd42-da1662ecbbf6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22753 does not affect version 6.0.8-tuxcare.7 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-22753. The vulnerability requires PathPatternRequestMatcher and PathPatternRequestMatcher.Builder components that were introduced in Spring Security 7.0.0 and do not exist in version 6.0.8. The target version uses different request matching implementations (MvcRequestMatcher, AntPathRequestMatcher) that predate the vulnerable architecture.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22754",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-config@6.0.8-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:beef0cca-e258-5f72-bf25-0a121e544c86",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22754 does not affect version 6.0.8-tuxcare.7 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcher (introduced in Spring Security 7.0) where basePath configuration is not properly applied. Version 6.0.8 uses MvcRequestMatcher for servlet-path support, which correctly implements the servletPath check and does not have the builder reassignment bug. The vulnerable code patterns from bo...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-config@6.0.8-tuxcare.7"
    }
  ]
}