{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:2dbc1960-f3b4-5b7e-a6f8-a24515472bef",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.4.RELEASE-tuxcare.1",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.4.RELEASE-tuxcare.1",
      "version": "5.1.4.RELEASE-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.4.RELEASE",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.1.4.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.4.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f14098f0-d099-52e0-81c1-789b06b8c59c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose. CVE-2018-15801 affects Spring Security 5.1.x prior to 5.1.2. The target version is 5.1.4.RELEASE-tuxcare.2, which already contains the upstream fix. The vulnerability involved using Java URL.equals() for JWT issuer validation, which can perform DNS resolution and normalization causing unintended matches between different issuer URLs. The fix changed from URL object comparison to string comparison. This fix was authored by Josh Cummings (josh.cummings@gmail.com) and shipped in upstream Spring Security 5.1.2+. TuxCare onboarded version 5.1.4.RELEASE which already contained this upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.4.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:057da090-4a40-5d04-9daf-4e6499252ff3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22748 does not affect version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 5.1.4.RELEASE is not affected by CVE-2026-22748. The vulnerable API pattern (NimbusJwtDecoder.withIssuerLocation and NimbusReactiveJwtDecoder.withIssuerLocation builder methods) does not exist in this version. Version 5.1.4 uses an older API design with NimbusJwtDecoderJwkSupport (constructor-based) and JwtDecoders.fromOidcIssuerLocation() static factory method, which already in...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.4.RELEASE-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a5951dbf-5d18-5307-874a-399f11edf226",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41707 does not affect version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 5.1.4.RELEASE contains no DPoP code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.4.RELEASE-tuxcare.1"
    }
  ]
}