{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:bd8fca21-404c-53ee-b433-54e1162fc735",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.11-tuxcare.10",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.11-tuxcare.10",
      "version": "5.7.11-tuxcare.10",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.11",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.7.11"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2007-1651",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.11-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:f4cfc31f-9fdb-5f0c-a8bd-a21d9035474d",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2007-1651 is a false positive for org.springframework.security:spring-security-oauth2-jose 5.7.11-tuxcare.10. direct vulnerability is in OpenID project"
      }
    },
    {
      "id": "CVE-2007-1652",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.11-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:ea83563c-e9c6-59c3-99b7-d0f6153a94a2",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-oauth2-jose 5.7.11-tuxcare.10. direct vulnerability is in OpenID project"
      }
    },
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.11-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:3cbec652-2aa1-5d5e-8f2a-fd495dfb041d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 5.7.11-tuxcare.10 of org.springframework.security:spring-security-oauth2-jose. The target Spring Security 5.7.11-tuxcare.11 is NOT AFFECTED by CVE-2018-15801. The vulnerability (JWT issuer validation bypass via URL.equals() DNS resolution) was fixed in upstream commit 19649db9ce by Josh Cummings, which was already present in the upstream release that TuxCare onboarded. The target uses string-based comparison (issuer.equals(claimValue.toString())) instead of the vulnerable URL object comparison, and the MappedJwtClaimSetConverter returns issuer claims as Strings (via .toExternalForm()) rather than URL objects. This is an upstream fix that shipped before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.11-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:6abaf6d6-ef83-5683-ae31-e2813649b153",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-22748 is a false positive for org.springframework.security:spring-security-oauth2-jose 5.7.11-tuxcare.10. direct vulnerability is in Spring Security project - affected versions are spring-security-oauth2-jose 6.3.0-6.3.14 / 6.4.0-6.4.14 / 6.5.0-6.5.9 / 7.0.0-7.0.4, version 5.7.11 is not in this range"
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.11-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:1c95622a-9388-5383-8806-0a3542aa0e1c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41707 does not affect version 5.7.11-tuxcare.10 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 5.7.11 contains no DPoP code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.11-tuxcare.10"
    }
  ]
}