{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:370e48e8-67f3-541e-a359-b03237a0b740",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.7-tuxcare.2",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.7-tuxcare.2",
      "version": "5.6.7-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.7",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.6.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.7-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:362f1326-4285-5a05-8b7a-f840939a9f95",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 5.6.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. The target (Spring Security 5.6.7) is not affected by CVE-2018-15801. The vulnerability was fixed in upstream commit 19649db9ce (November 2018) which replaced unsafe URL.equals() comparison with String-based comparison. This fix was already present in Spring Security 5.6.7 before TuxCare onboarded it (first TuxCare commit a7dda868db). The current code uses issuer.equals(claimValue.toString()) which safely performs String comparison, preventing the authorization bypass that URL.equals() quirks could enable.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.7-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e3e28738-7ddc-58f5-8458-075cd54e8666",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22748 does not affect version 5.6.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Version 5.6.7 is NOT affected by CVE-2026-22748. The vulnerability concerns the `withIssuerLocation()` method in NimbusJwtDecoder and NimbusReactiveJwtDecoder, which does not exist in this version. The method was introduced in Spring Security 6.1.0 (April 2023), well after the 5.6.7 release. TuxCare's selective backporting to versions 6.2.7, 6.2.8, and 6.4.13 (but not to 5.x versions) confirms ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.7-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7054b2f9-9673-5d88-bff6-f080e9f6e7dc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41707 does not affect version 5.6.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 5.6.7 contains no DPoP code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.7-tuxcare.2"
    }
  ]
}