{
  "@id": "urn:uuid:fd6138d1-5291-4e28-9a38-cd094ea673e8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T01:26:53.747840+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@5.7.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.7.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T01:26:24.515228+00:00",
      "status_notes": "Vulnerability CVE-2023-34034 affects version 5.7.7-tuxcare.4 of org.springframework.security:spring-security-config.",
      "vulnerability": {
        "name": "CVE-2023-34034"
      },
      "action_statement": "Vulnerability CVE-2023-34034 affects version 5.7.7-tuxcare.4 of org.springframework.security:spring-security-config."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@5.7.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.7.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T01:26:24.515228+00:00",
      "status_notes": "Vulnerability CVE-2023-34035 affects version 5.7.7-tuxcare.4 of org.springframework.security:spring-security-config.",
      "vulnerability": {
        "name": "CVE-2023-34035"
      },
      "action_statement": "Vulnerability CVE-2023-34035 affects version 5.7.7-tuxcare.4 of org.springframework.security:spring-security-config."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@5.7.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.7.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T01:26:24.515228+00:00",
      "status_notes": "Vulnerability CVE-2023-34042 does not affect version 5.7.7-tuxcare.4 of org.springframework.security:spring-security-config. not_affected \u2014 Version 5.7.7 is not affected by CVE-2023-34042. The vulnerable spring-security.xsd symlink with world-writable permissions was introduced in version 5.7.9 (commit 1eefd433b6, May 2023) and fixed in version 5.7.11 (commit 5b293d2116, September 2023). Version 5.7.7 was released before the vulnerability was introduced and contains neither the vulnerable symlink nor the build code to package it. T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34042"
      },
      "impact_statement": "not_affected \u2014 Version 5.7.7 is not affected by CVE-2023-34042. The vulnerable spring-security.xsd symlink with world-writable permissions was introduced in version 5.7.9 (commit 1eefd433b6, May 2023) and fixed in version 5.7.11 (commit 5b293d2116, September 2023). Version 5.7.7 was released before the vulnerability was introduced and contains neither the vulnerable symlink nor the build code to package it. T..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@5.7.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.7.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T01:26:53.747840+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 is fixed in version 5.7.7-tuxcare.4 of org.springframework.security:spring-security-config.",
      "vulnerability": {
        "name": "CVE-2025-22223"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@5.7.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.7.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T01:26:24.515228+00:00",
      "status_notes": "Vulnerability CVE-2026-22753 does not affect version 5.7.7-tuxcare.4 of org.springframework.security:spring-security-config. Target version 5.7.7 is not affected by CVE-2026-22753. The vulnerability affects Spring Security 7.0.0-7.0.4 and requires PathPatternRequestMatcher.Builder, a feature introduced in Spring Security 6.x (requires Spring Framework 6.x). Version 5.7.7 uses Spring Framework 5.3.25 and employs the older AntPathRequestMatcher/MvcRequestMatcher architecture with direct servlet path setters. The vulnerable code path (PathPatternRequestMatcher.Builder bean lookup in HttpSecurityConfiguration and PathPatternRequestMatcherFactoryBean.basePath() reassignment) does not exist in this version. Rule 5 Type A1 applies: the INPUT type (PathPatternRequestMatcher.Builder bean configuration) is not processed anywhere in the target codebase.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22753"
      },
      "impact_statement": "Target version 5.7.7 is not affected by CVE-2026-22753. The vulnerability affects Spring Security 7.0.0-7.0.4 and requires PathPatternRequestMatcher.Builder, a feature introduced in Spring Security 6.x (requires Spring Framework 6.x). Version 5.7.7 uses Spring Framework 5.3.25 and employs the older AntPathRequestMatcher/MvcRequestMatcher architecture with direct servlet path setters. The vulnerable code path (PathPatternRequestMatcher.Builder bean lookup in HttpSecurityConfiguration and PathPatternRequestMatcherFactoryBean.basePath() reassignment) does not exist in this version. Rule 5 Type A1 applies: the INPUT type (PathPatternRequestMatcher.Builder bean configuration) is not processed anywhere in the target codebase."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@5.7.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@5.7.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T01:26:24.515228+00:00",
      "status_notes": "Vulnerability CVE-2026-22754 does not affect version 5.7.7-tuxcare.4 of org.springframework.security:spring-security-config. Spring Security 5.7.7 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a fluent API bug in PathPatternRequestMatcherFactoryBean where the base path configuration is lost. Spring Security 5.7.7 uses a completely different architecture (MvcRequestMatcher, AntPathRequestMatcher, RegexRequestMatcher) without the vulnerable PathPatternRequestMatcher infrastructure. The fluent builder pattern bug does not exist in 5.7.7's implementation, which uses direct setters that correctly apply servlet path configuration.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22754"
      },
      "impact_statement": "Spring Security 5.7.7 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a fluent API bug in PathPatternRequestMatcherFactoryBean where the base path configuration is lost. Spring Security 5.7.7 uses a completely different architecture (MvcRequestMatcher, AntPathRequestMatcher, RegexRequestMatcher) without the vulnerable PathPatternRequestMatcher infrastructure. The fluent builder pattern bug does not exist in 5.7.7's implementation, which uses direct setters that correctly apply servlet path configuration."
    }
  ]
}