{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a4921149-74ac-50e9-acea-31f29b09d24d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.9-tuxcare.3",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.9-tuxcare.3",
      "version": "5.6.9-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.9",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.6.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:6d6deb24-7ad3-5211-9341-7b442f67d51e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 5.6.9-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose. Spring Security 5.6.9 is NOT affected by CVE-2018-15801. The vulnerability affected versions 5.1.x prior to 5.1.2 and involved JWT issuer validation using Java's URL.equals() method, which has problematic equality semantics (DNS resolution, normalization) that could allow different issuer URLs to be treated as equal. The fix (commit 19649db9ce) changed issuer validation from URL object comparison to String comparison. This fix was already present in the upstream Spring Security 5.6.9 release that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the onboarding commit 225cbba428. The target code uses String-based issuer comparison throughout the validation chain, with no URL.equals() calls present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:9638b878-aa09-5b51-b2ee-0f81dab106f7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22748 does not affect version 5.6.9-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Version 5.6.9 is not affected by CVE-2026-22748. The vulnerability concerns the `NimbusJwtDecoder.withIssuerLocation()` and `NimbusReactiveJwtDecoder.withIssuerLocation()` static builder methods that were misleadingly named (suggesting automatic issuer validation when they provided none). These methods were introduced in Spring Security 6.1.0 (April 2023), approximately 5 months after version 5...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.9-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:5adc07c3-9b47-5e00-8367-c118e21e6489",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41707 does not affect version 5.6.9-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 5.6.9 contains no DPoP code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.9-tuxcare.3"
    }
  ]
}