{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:13be5ef8-48e6-5d6d-88b6-090193394912",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.2.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.2.RELEASE-tuxcare.1",
      "version": "5.1.2.RELEASE-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.2.RELEASE",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.1.2.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.2.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d0b8d838-a672-54d5-acfa-c19f9e9b8e4f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 5.1.2.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose. CVE-2018-15801 is NOT present in this target. The vulnerability involved JWT issuer validation using Java's URL.equals() method, which performs DNS resolution and could allow authorization bypass when two different issuer URLs resolve to the same IP. The target at version 5.1.2.RELEASE contains the upstream fix (commits dc4aa3d017 and 5478b74116) that replaced URL.equals() comparison with String comparison in both JwtIssuerValidator and MappedJwtClaimSetConverter. This fix was authored by Josh Cummings (josh.cummings@gmail.com) and shipped in the upstream Spring Security 5.1.2.RELEASE before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.2.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0d3d56b7-e807-5dba-b221-3cdde743c36a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22748 does not affect version 5.1.2.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Version 5.1.2.RELEASE is not affected by CVE-2026-22748. The vulnerable API methods `NimbusJwtDecoder.withIssuerLocation()` and `NimbusReactiveJwtDecoder.withIssuerLocation()` do not exist in this version. The equivalent functionality is provided by `JwtDecoders.fromOidcIssuerLocation()` and `ReactiveJwtDecoders.fromOidcIssuerLocation()`, which have always included automatic issuer validation s...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.2.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0b6af73d-2570-573c-be8b-4314c4e681c0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41707 affects version 5.1.2.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.2.RELEASE-tuxcare.1"
    }
  ]
}