{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:29148007-05ba-5720-870a-e6685bef700a",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.2-tuxcare.11",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.2-tuxcare.11",
      "version": "6.2.2-tuxcare.11",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.2",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.2.2"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.2-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:d587cdce-2bdf-56ea-9747-016cc09b0626",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 6.2.2-tuxcare.11 of org.springframework.security:spring-security-oauth2-jose. Spring Security 6.2.2 is NOT affected by CVE-2018-15801. The vulnerability was fixed in upstream Spring Security 5.1.2 (November 2018) via commit 19649db9ce, which changed JWT issuer validation from problematic URL.equals() comparison to String-based comparison. The target version 6.2.2 (released years later) inherited this fix from upstream. Both JwtIssuerValidator and MappedJwtClaimSetConverter contain the defensive code that prevents issuer mismatch via URL comparison semantics.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.2-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:5bc91338-18f2-5f7d-abea-882cc7549919",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-22748 is a false positive for org.springframework.security:spring-security-oauth2-jose 6.2.2-tuxcare.11. direct vulnerability is in Spring Security project - affected versions are spring-security-oauth2-jose 6.3.0-6.3.14 / 6.4.0-6.4.14 / 6.5.0-6.5.9 / 7.0.0-7.0.4, version 6.2.2 is not in this range"
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.2-tuxcare.11"
        }
      ],
      "bom-ref": "urn:uuid:cb7ce7ab-283d-51ff-8d6f-3d5c18b5390e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41707 does not affect version 6.2.2-tuxcare.11 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 6.2.2 contains no DPoP code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.2-tuxcare.11"
    }
  ]
}