{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:30eb2c35-4dbe-52fd-8806-8623f923820f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-bom",
      "purl": "pkg:maven/org.springframework.security/spring-security-bom@5.5.8-tuxcare.4",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-bom@5.5.8-tuxcare.4",
      "version": "5.5.8-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-bom",
            "purl": "pkg:maven/org.springframework.security/spring-security-bom@5.5.8",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.5.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-22112",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-bom@5.5.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:544f7921-6ef7-5d35-971b-4eb64651ff78",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22112 does not affect version 5.5.8-tuxcare.4 of org.springframework.security:spring-security-bom. The target repository (Spring Security 5.5.8) is NOT AFFECTED by CVE-2021-22112. The upstream fix (commit 3116369f027 by Rob Winch, January 22, 2021) was already present in the Spring Security 5.5.8 release when TuxCare onboarded it (commit 8cf3277976, October 2026). The vulnerable guard pattern `if (!responseWrapper.isContextSaved())` that prevented multiple SecurityContext saves has been removed, and the fix's tracking mechanism (`isSaveContextInvoked` flag) is properly implemented in the target code. This is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-bom@5.5.8-tuxcare.4"
    }
  ]
}