{
  "@id": "urn:uuid:b6498a57-f985-4d34-8266-5ebe3596492b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T15:13:52.433820+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2023-34034 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-config. Target Spring Security 6.3.9 is NOT affected by CVE-2023-34034. The vulnerability (pattern matching mismatch when using \"**\" in WebFlux configuration) was fixed in upstream commit 7813a9ba26 (July 5, 2023) which is present in the upstream 6.3.9 release that TuxCare onboarded. All four affected files contain the fix: pattern strings are normalized via initFullPathPattern() before parsing, ensuring consistent matching behavior between Spring Security and Spring WebFlux.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 6.1.0, <= 6.1.1; >= 6.0.0, <= 6.0.4; >= 5.8.0, <= 5.8.4; >= 5.7.0, <= 5.7.9; >= 5.6.0, <= 5.6.11), Snyk (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34034"
      },
      "impact_statement": "Target Spring Security 6.3.9 is NOT affected by CVE-2023-34034. The vulnerability (pattern matching mismatch when using \"**\" in WebFlux configuration) was fixed in upstream commit 7813a9ba26 (July 5, 2023) which is present in the upstream 6.3.9 release that TuxCare onboarded. All four affected files contain the fix: pattern strings are normalized via initFullPathPattern() before parsing, ensuring consistent matching behavior between Spring Security and Spring WebFlux.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 6.1.0, <= 6.1.1; >= 6.0.0, <= 6.0.4; >= 5.8.0, <= 5.8.4; >= 5.7.0, <= 5.7.9; >= 5.6.0, <= 5.6.11), Snyk (>= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2023-34035 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-config. Spring Security 6.3.9 is not affected by CVE-2023-34035. The vulnerability affects versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2. The target version 6.3.9 already contains the upstream fix (commit 4ca54683ae by Josh Cummings, July 2023) that was shipped in the original Spring Security 6.3.9 release before TuxCare onboarded it. The fix implements runtime servlet registration validation that prevents authorization rule misconfiguration in multi-servlet environments.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 5.8.0, <= 5.8.4; >= 6.0.0, <= 6.0.4; >= 6.1.0, <= 6.1.1), Snyk (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34035"
      },
      "impact_statement": "Spring Security 6.3.9 is not affected by CVE-2023-34035. The vulnerability affects versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2. The target version 6.3.9 already contains the upstream fix (commit 4ca54683ae by Josh Cummings, July 2023) that was shipped in the original Spring Security 6.3.9 release before TuxCare onboarded it. The fix implements runtime servlet registration validation that prevents authorization rule misconfiguration in multi-servlet environments.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), NVD (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2), cve.org (>= 5.8.0, <= 5.8.4; >= 6.0.0, <= 6.0.4; >= 6.1.0, <= 6.1.1), Snyk (>= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2023-34042 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-config. not_affected \u2014 The target repository Spring Security 6.3.9 is NOT AFFECTED by CVE-2023-34042. The vulnerability concerned a world-writable spring-security.xsd file caused by using a symlink in the source tree. The fix (commit 5b293d21 by upstream maintainer Rob Winch) removed the symlink and replaced it with build-time generation using proper file operations. This fix was already present in upstream Spring Se...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34042"
      },
      "impact_statement": "not_affected \u2014 The target repository Spring Security 6.3.9 is NOT AFFECTED by CVE-2023-34042. The vulnerability concerned a world-writable spring-security.xsd file caused by using a symlink in the source tree. The fix (commit 5b293d21 by upstream maintainer Rob Winch) removed the symlink and replaced it with build-time generation using proper file operations. This fix was already present in upstream Spring Se..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2025-22223 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-config. not_affected \u2014 Spring Security 6.3.9 is not affected by CVE-2025-22223. The vulnerability exists only in the custom UniqueSecurityAnnotationScanner class, which was introduced in Spring Security 6.4.0 (released November 2024). Version 6.3.9 predates this component and uses Spring Framework's built-in MergedAnnotations mechanism for method annotation scanning, which correctly handles parameterized generic type...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22223"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.3.9 is not affected by CVE-2025-22223. The vulnerability exists only in the custom UniqueSecurityAnnotationScanner class, which was introduced in Spring Security 6.4.0 (released November 2024). Version 6.3.9 predates this component and uses Spring Framework's built-in MergedAnnotations mechanism for method annotation scanning, which correctly handles parameterized generic type..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2026-22753 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-config. Spring Security 6.3.9 is NOT AFFECTED by CVE-2026-22753. The vulnerability requires PathPatternRequestMatcher and PathPatternRequestMatcher.Builder classes introduced in Spring Security 7.0+. Version 6.3.9 uses a fundamentally different request matching architecture (MvcRequestMatcher/AntPathRequestMatcher) that predates the vulnerable infrastructure. The vulnerable pattern\u2014ignoring user-provided PathPatternRequestMatcher.Builder beans with configured base paths\u2014cannot exist because these classes and the bean-based configuration mechanism do not exist in 6.3.9. Exhaustive searches confirmed the absence of the vulnerable component.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22753"
      },
      "impact_statement": "Spring Security 6.3.9 is NOT AFFECTED by CVE-2026-22753. The vulnerability requires PathPatternRequestMatcher and PathPatternRequestMatcher.Builder classes introduced in Spring Security 7.0+. Version 6.3.9 uses a fundamentally different request matching architecture (MvcRequestMatcher/AntPathRequestMatcher) that predates the vulnerable infrastructure. The vulnerable pattern\u2014ignoring user-provided PathPatternRequestMatcher.Builder beans with configured base paths\u2014cannot exist because these classes and the bean-based configuration mechanism do not exist in 6.3.9. Exhaustive searches confirmed the absence of the vulnerable component."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-config@6.3.9-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:13:52.433820+00:00",
      "status_notes": "Vulnerability CVE-2026-22754 does not affect version 6.3.9-tuxcare.3 of org.springframework.security:spring-security-config. Spring Security 6.3.9 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcherFactoryBean (introduced in version 7.0.x) where the builder's basePath() return value is not captured, causing servlet-path configuration to be lost. Version 6.3.9 uses a completely different architecture: MvcRequestMatcher for servlet-path handling, with no builder assignment bug. The vulnerable class PathPatternRequestMatcherFactoryBean does not exist in 6.3.9.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22754"
      },
      "impact_statement": "Spring Security 6.3.9 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcherFactoryBean (introduced in version 7.0.x) where the builder's basePath() return value is not captured, causing servlet-path configuration to be lost. Version 6.3.9 uses a completely different architecture: MvcRequestMatcher for servlet-path handling, with no builder assignment bug. The vulnerable class PathPatternRequestMatcherFactoryBean does not exist in 6.3.9."
    }
  ]
}