{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:fa895793-af62-5f76-956c-c62bdbc817f9",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.7",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.7",
      "version": "6.0.8-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.0.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:ef2e206d-43ab-5023-b7aa-9018dff9febd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 6.0.8-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose. CVE-2018-15801 affects Spring Security 5.1.x prior to 5.1.2 due to JWT issuer validation using URL.equals() comparison, which can treat semantically different URLs as equivalent. The target Spring Security 6.0.8 is not affected because the fix (commit 19649db9ce) was already included in the upstream release. The current code compares issuers as Strings using String.equals(), eliminating the URL semantic equivalence vulnerability. This is an upstream fix authored by josh.cummings@gmail.com that shipped before TuxCare onboarded version 6.0.8.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:5b6ea2df-37d0-5a1c-a759-74caa9aa96e0",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22748 does not affect version 6.0.8-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security version 6.0.8 is not affected by CVE-2026-22748. The vulnerability concerns the NimbusJwtDecoder.withIssuerLocation() and NimbusReactiveJwtDecoder.withIssuerLocation() builder methods failing to automatically validate JWT issuer claims. These methods do not exist in version 6.0.8 - they were introduced in version 6.1.0, approximately 225 commits after the 6.0.8 release.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:47231cc3-da43-5d1e-aab0-3c9c65615604",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41707 does not affect version 6.0.8-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 6.0.8 contains no DPoP code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.8-tuxcare.7"
    }
  ]
}