{
  "@id": "urn:uuid:2da4cf9c-7c61-4699-9775-a2507f0bf92a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 32,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T16:31:00.055998+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.2.7-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.2.7-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T09:10:25.284357+00:00",
      "status_notes": "Vulnerability CVE-2023-34034 does not affect version 6.2.7-tuxcare.8 of org.springframework.security:spring-security-config. CVE-2023-34034 is not present in this version. The vulnerability involves a pattern matching mismatch between Spring Security and Spring WebFlux when using \"**\" patterns, allowing security bypass. The fix (commit 7813a9ba26) was included in the upstream Spring Security 6.2.7 release that TuxCare onboarded, ensuring PathPatternParser.defaultInstance with initFullPathPattern() is used for consistent pattern interpretation between security rules and routing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 6.1.0, <= 6.1.1; >= 6.0.0, <= 6.0.4; >= 5.8.0, <= 5.8.4; >= 5.7.0, <= 5.7.9; >= 5.6.0, <= 5.6.11), Snyk (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34034"
      },
      "impact_statement": "CVE-2023-34034 is not present in this version. The vulnerability involves a pattern matching mismatch between Spring Security and Spring WebFlux when using \"**\" patterns, allowing security bypass. The fix (commit 7813a9ba26) was included in the upstream Spring Security 6.2.7 release that TuxCare onboarded, ensuring PathPatternParser.defaultInstance with initFullPathPattern() is used for consistent pattern interpretation between security rules and routing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 6.1.0, <= 6.1.1; >= 6.0.0, <= 6.0.4; >= 5.8.0, <= 5.8.4; >= 5.7.0, <= 5.7.9; >= 5.6.0, <= 5.6.11), Snyk (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.2.7-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.2.7-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2023-34035 does not affect version 6.2.7-tuxcare.8 of org.springframework.security:spring-security-config. CVE-2023-34035 does not affect this version of Spring Security. The target version 6.2.7 includes an upstream fix that was already present when TuxCare onboarded this release. The vulnerability concerned authorization rule misconfiguration when using requestMatchers(String) with multiple servlets including DispatcherServlet. The upstream fix (commit 4ca54683ae, November 2023) introduced a DeferredRequestMatcher mechanism that defers matcher selection to runtime, intelligently choosing between MvcRequestMatcher and AntPathRequestMatcher based on servlet context, or throwing an error when ambiguous. This prevents the authorization bypass that could occur when the wrong matcher type was automatically selected for non-Spring-MVC endpoints in multi-servlet applications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 5.8.0, <= 5.8.4; >= 6.0.0, <= 6.0.4; >= 6.1.0, <= 6.1.1), Snyk (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34035"
      },
      "impact_statement": "CVE-2023-34035 does not affect this version of Spring Security. The target version 6.2.7 includes an upstream fix that was already present when TuxCare onboarded this release. The vulnerability concerned authorization rule misconfiguration when using requestMatchers(String) with multiple servlets including DispatcherServlet. The upstream fix (commit 4ca54683ae, November 2023) introduced a DeferredRequestMatcher mechanism that defers matcher selection to runtime, intelligently choosing between MvcRequestMatcher and AntPathRequestMatcher based on servlet context, or throwing an error when ambiguous. This prevents the authorization bypass that could occur when the wrong matcher type was automatically selected for non-Spring-MVC endpoints in multi-servlet applications.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 5.8.0, <= 5.8.4; >= 6.0.0, <= 6.0.4; >= 6.1.0, <= 6.1.1), Snyk (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.2.7-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.2.7-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-03T14:40:31.077655+00:00",
      "status_notes": "Vulnerability CVE-2023-34042 does not affect version 6.2.7-tuxcare.8 of org.springframework.security:spring-security-config. not_affected \u2014 Target repository is NOT AFFECTED by CVE-2023-34042. The vulnerability concerned a world-writable symlink (spring-security.xsd) in the spring-security-config JAR that could allow unauthorized modification after extraction. The upstream fix (commit 5b293d2116) removed the symlink and replaced it with automated build-time XSD generation using CreateVersionlessXsdTask. This fix was already present...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34042"
      },
      "impact_statement": "not_affected \u2014 Target repository is NOT AFFECTED by CVE-2023-34042. The vulnerability concerned a world-writable symlink (spring-security.xsd) in the spring-security-config JAR that could allow unauthorized modification after extraction. The upstream fix (commit 5b293d2116) removed the symlink and replaced it with automated build-time XSD generation using CreateVersionlessXsdTask. This fix was already present..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.2.7-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.2.7-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-05T16:31:00.055998+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 affects version 6.2.7-tuxcare.8 of org.springframework.security:spring-security-config, and is fixed in 6.2.7-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "action_statement": "Vulnerability CVE-2025-22223 affects version 6.2.7-tuxcare.8 of org.springframework.security:spring-security-config, and is fixed in 6.2.7-tuxcare.9."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.2.7-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.2.7-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-27T11:09:44.771182+00:00",
      "status_notes": "Vulnerability CVE-2026-22753 does not affect version 6.2.7-tuxcare.8 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 6.2.7 is not affected by CVE-2026-22753. The vulnerability concerns PathPatternRequestMatcher.Builder bean handling, a feature introduced in version 7.0.0. Version 6.2.7 uses a completely different request matching architecture based on MvcRequestMatcher and AntPathRequestMatcher, with servlet path handling implemented via MvcRequestMatcher.setServletPath(). The vulnerable code ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22753"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.2.7 is not affected by CVE-2026-22753. The vulnerability concerns PathPatternRequestMatcher.Builder bean handling, a feature introduced in version 7.0.0. Version 6.2.7 uses a completely different request matching architecture based on MvcRequestMatcher and AntPathRequestMatcher, with servlet path handling implemented via MvcRequestMatcher.setServletPath(). The vulnerable code ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.2.7-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.2.7-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-27T11:09:44.771182+00:00",
      "status_notes": "Vulnerability CVE-2026-22754 does not affect version 6.2.7-tuxcare.8 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 6.2.7 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean (introduced in 7.x) where basePath assignment was missing. Version 6.2.7 uses a different architecture (MvcRequestMatcher for servlet-path handling) that does not have this vulnerability pattern.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22754"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.2.7 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean (introduced in 7.x) where basePath assignment was missing. Version 6.2.7 uses a different architecture (MvcRequestMatcher for servlet-path handling) that does not have this vulnerability pattern."
    }
  ]
}