{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:aa5df2aa-ce99-5682-b6da-36d05becd87b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-crypto",
      "purl": "pkg:maven/org.springframework.security/spring-security-crypto@6.5.11-tuxcare.3",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-crypto@6.5.11-tuxcare.3",
      "version": "6.5.11-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-crypto",
            "purl": "pkg:maven/org.springframework.security/spring-security-crypto@6.5.11",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.5.11"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-22228",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-crypto@6.5.11-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:3be8179f-47d3-5e05-88b7-ec7497e07cd0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-22228 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-crypto. Version 6.5.11 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-mg83-c7gq-rv5c (affected below 6.4.4), CVE record (affected below 6.4.4), Snyk (affected below 6.4.4).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-22234",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-crypto@6.5.11-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:35acbf9b-b9c6-5e6a-880e-4ddfaaab5fde",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-22234 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-crypto. not_affected \u2014 CVE-2025-22234 is not present in spring-security 6.5.11-tuxcare.4. The vulnerability (timing attack side channel in DaoAuthenticationProvider due to CVE-2025-22228's 72-byte password limit) was fixed by upstream Spring Security maintainer Joe Grandja in commit c1aa99fdd21 (April 17, 2025), which was already included in the upstream 6.5.11 release that TuxCare onboarded. The fix adds a `for_chec...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47842",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-crypto@6.5.11-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:1def30b3-1e5b-579b-b268-ec3fc9f4ae80",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-crypto."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-crypto@6.5.11-tuxcare.3"
    }
  ]
}