{
  "@id": "urn:uuid:2fc6e611-66cb-4236-b69d-74e5ded1ba81",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-11T03:52:58.479594+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2023-34034 affects version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-config.",
      "vulnerability": {
        "name": "CVE-2023-34034"
      },
      "action_statement": "Vulnerability CVE-2023-34034 affects version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-config."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2023-34035 affects version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-config.",
      "vulnerability": {
        "name": "CVE-2023-34035"
      },
      "action_statement": "Vulnerability CVE-2023-34035 affects version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-config."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2023-34042 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 5.6.5 is NOT AFFECTED by CVE-2023-34042. The vulnerability concerns a world-writable symlink file (spring-security.xsd) that was introduced in version 5.7.9 and fixed in 5.7.11. Version 5.6.5 predates the introduction of this symlink and uses only a spring.schemas mapping to redirect the versionless XSD URL to spring-security-5.6.xsd. No physical spring-security.xsd file exists ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34042"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.6.5 is NOT AFFECTED by CVE-2023-34042. The vulnerability concerns a world-writable symlink file (spring-security.xsd) that was introduced in version 5.7.9 and fixed in 5.7.11. Version 5.6.5 predates the introduction of this symlink and uses only a spring.schemas mapping to redirect the versionless XSD URL to spring-security-5.6.xsd. No physical spring-security.xsd file exists ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 is fixed in version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-config.",
      "vulnerability": {
        "name": "CVE-2025-22223"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2026-22753 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-config. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.6.5 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4wrg-8wpc-h923 (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22753"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.6.5 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4wrg-8wpc-h923 (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@5.6.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.6.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-11T03:52:58.479594+00:00",
      "status_notes": "Vulnerability CVE-2026-22754 does not affect version 5.6.5-tuxcare.4 of org.springframework.security:spring-security-config. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.6.5 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4vrc-j85c-598c (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22754"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.6.5 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4vrc-j85c-598c (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    }
  ]
}