{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:bb5a3fca-61ed-5665-aff5-e326eff6518f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.9",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.9",
      "version": "5.7.14-tuxcare.9",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.7.14"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2007-1651",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:7dcf7560-f61f-58f0-ac19-89addf3b2514",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2007-1651 is a false positive for org.springframework.security:spring-security-oauth2-jose 5.7.14-tuxcare.9. direct vulnerability is in OpenID project"
      }
    },
    {
      "id": "CVE-2007-1652",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:54daf344-13ed-53ff-823f-ad94d701bf6a",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-oauth2-jose 5.7.14-tuxcare.9. direct vulnerability is in OpenID project"
      }
    },
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:1bf66e10-4c07-5ca5-ab52-69b0316279e1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 5.7.14-tuxcare.9 of org.springframework.security:spring-security-oauth2-jose. Spring Security 5.7.14 is not affected by CVE-2018-15801. The vulnerability involved JWT issuer validation using Java URL object comparison (URL.equals()), which can incorrectly treat different issuer URLs as equivalent due to DNS resolution side effects. The upstream vendor (Spring Security project) fixed this in late 2018 by replacing URL object comparison with string-based comparison. This fix was already present in the upstream Spring Security 5.7.14 release that TuxCare onboarded, as confirmed by git ancestry analysis showing fix commit 19649db9ce predates the first TuxCare commit by 4,239 commits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:81f4834d-aa7f-5399-9cd7-94dce05deb6a",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-22748 is a false positive for org.springframework.security:spring-security-oauth2-jose 5.7.14-tuxcare.9. direct vulnerability is in Spring Security project - affected versions are spring-security-oauth2-jose 6.3.0-6.3.14 / 6.4.0-6.4.14 / 6.5.0-6.5.9 / 7.0.0-7.0.4, version 5.7.14 is not in this range"
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.9"
        }
      ],
      "bom-ref": "urn:uuid:7774f08c-5c88-5498-906b-025f602bdaa4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41707 does not affect version 5.7.14-tuxcare.9 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 5.7.14 contains no DPoP code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.7.14-tuxcare.9"
    }
  ]
}