{
  "@id": "urn:uuid:eaa1b61f-8f78-44ef-aedc-92ad2534c2bf",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T19:13:13.380013+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2023-34034 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-config. CVE-2023-34034 is not present in Spring Security 6.0.7-tuxcare.2. The vulnerability (pattern matching mismatch between Spring Security and Spring WebFlux when using \"**\" patterns) was fixed in upstream commit 7813a9ba26 dated 2023-07-05, which added `initFullPathPattern()` normalization before pattern parsing. This fix was already included in the upstream Spring Security 6.0.7 release that TuxCare onboarded on 2026-09-14. All relevant files (PathPatternParserServerWebExchangeMatcher.java, AbstractServerWebExchangeMatcherRegistry.java, ServerWebExchangeMatchers.java) contain the fix. The target is not affected because the vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 6.1.0, <= 6.1.1; >= 6.0.0, <= 6.0.4; >= 5.8.0, <= 5.8.4; >= 5.7.0, <= 5.7.9; >= 5.6.0, <= 5.6.11), Snyk (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34034"
      },
      "impact_statement": "CVE-2023-34034 is not present in Spring Security 6.0.7-tuxcare.2. The vulnerability (pattern matching mismatch between Spring Security and Spring WebFlux when using \"**\" patterns) was fixed in upstream commit 7813a9ba26 dated 2023-07-05, which added `initFullPathPattern()` normalization before pattern parsing. This fix was already included in the upstream Spring Security 6.0.7 release that TuxCare onboarded on 2026-09-14. All relevant files (PathPatternParserServerWebExchangeMatcher.java, AbstractServerWebExchangeMatcherRegistry.java, ServerWebExchangeMatchers.java) contain the fix. The target is not affected because the vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 6.1.0, <= 6.1.1; >= 6.0.0, <= 6.0.4; >= 5.8.0, <= 5.8.4; >= 5.7.0, <= 5.7.9; >= 5.6.0, <= 5.6.11), Snyk (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2023-34035 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-config. CVE-2023-34035 fix is already present in target version 6.0.7. The vulnerability allowed authorization rule misconfiguration when Spring MVC + multiple servlets existed and requestMatchers(String) was used for non-MVC endpoints. The fix (commit df239b6448) adds validation that throws IllegalArgumentException when multiple servlets are detected, preventing silent authorization bypass. This is an upstream fix by Josh Cummings, shipped in Spring Security 6.0.7 before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 5.8.0, <= 5.8.4; >= 6.0.0, <= 6.0.4; >= 6.1.0, <= 6.1.1), Snyk (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34035"
      },
      "impact_statement": "CVE-2023-34035 fix is already present in target version 6.0.7. The vulnerability allowed authorization rule misconfiguration when Spring MVC + multiple servlets existed and requestMatchers(String) was used for non-MVC endpoints. The fix (commit df239b6448) adds validation that throws IllegalArgumentException when multiple servlets are detected, preventing silent authorization bypass. This is an upstream fix by Josh Cummings, shipped in Spring Security 6.0.7 before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 5.8.0, <= 5.8.4; >= 6.0.0, <= 6.0.4; >= 6.1.0, <= 6.1.1), Snyk (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2023-34042 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-config. Spring Security 6.0.7 is not vulnerable as it is equal to upstream fix version - 6.0.7",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34042"
      },
      "impact_statement": "Spring Security 6.0.7 is not vulnerable as it is equal to upstream fix version - 6.0.7"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-config. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 6.0.7 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-hh3m-g4qj-4835 (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 6.0.7 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-hh3m-g4qj-4835 (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2026-22753 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-config. Spring Security 6.0.7 is not affected by CVE-2026-22753. The vulnerability requires the PathPatternRequestMatcher.Builder infrastructure introduced in Spring Security 7.0.0. Version 6.0.7 uses a fundamentally different request matching architecture (MvcRequestMatcher) that does not have the vulnerable pattern. The CVE affects \"Spring Security 7.0.0 through 7.0.4\" and the vulnerable code components (PathPatternRequestMatcher class, PathPatternRequestMatcherFactoryBean, and automatic builder bean discovery mechanism) are completely absent from the 6.0.7 codebase.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22753"
      },
      "impact_statement": "Spring Security 6.0.7 is not affected by CVE-2026-22753. The vulnerability requires the PathPatternRequestMatcher.Builder infrastructure introduced in Spring Security 7.0.0. Version 6.0.7 uses a fundamentally different request matching architecture (MvcRequestMatcher) that does not have the vulnerable pattern. The CVE affects \"Spring Security 7.0.0 through 7.0.4\" and the vulnerable code components (PathPatternRequestMatcher class, PathPatternRequestMatcherFactoryBean, and automatic builder bean discovery mechanism) are completely absent from the 6.0.7 codebase."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.0.7-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.0.7-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-09T19:13:13.380013+00:00",
      "status_notes": "Vulnerability CVE-2026-22754 does not affect version 6.0.7-tuxcare.4 of org.springframework.security:spring-security-config. Version 6.0.7 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcherFactoryBean (introduced in Spring Security 7.0.0) where a builder reassignment bug causes servlet-path configurations to be ignored. Version 6.0.7 does not contain PathPatternRequestMatcher or PathPatternRequestMatcherFactoryBean. Instead, it uses MvcRequestMatcher for servlet-path support, which correctly handles the configuration without the builder bug. The CVE's affected version range (7.0.0-7.0.4) is accurate; this vulnerability was introduced with new functionality in 7.0.0 and never existed in 6.0.7.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22754"
      },
      "impact_statement": "Version 6.0.7 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcherFactoryBean (introduced in Spring Security 7.0.0) where a builder reassignment bug causes servlet-path configurations to be ignored. Version 6.0.7 does not contain PathPatternRequestMatcher or PathPatternRequestMatcherFactoryBean. Instead, it uses MvcRequestMatcher for servlet-path support, which correctly handles the configuration without the builder bug. The CVE's affected version range (7.0.0-7.0.4) is accurate; this vulnerability was introduced with new functionality in 7.0.0 and never existed in 6.0.7."
    }
  ]
}