{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:94cdb8ee-fd88-5bab-9e00-d33d5647825f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.7-tuxcare.6",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.7-tuxcare.6",
      "version": "6.2.7-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.7",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.2.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.7-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:72d2f70c-f2d6-565b-8f12-b828ca4377b5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-oauth2-jose. CVE-2018-15801 does not affect Spring Security 6.2.7. The vulnerability involved JWT issuer validation using Java's URL.equals() method, which can perform DNS resolution and treat semantically different issuer URLs as equal, allowing authorization bypass. The fix (commit 19649db9ce, November 2018) changed issuer validation to use String comparison instead of URL object comparison. This fix was already present in the upstream Spring Security 6.2.7 release that TuxCare onboarded, authored by Josh Cummings (upstream maintainer). The target uses a delegation pattern with JwtClaimValidator but performs the same String-based comparison, providing equivalent protection against the vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.7-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:ec697e52-40d5-56a9-9dca-41e99ae09afd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22748 is fixed in version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-oauth2-jose."
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.7-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:a2dd91cb-9c93-501c-ba26-13cf1a5fa77d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41707 does not affect version 6.2.7-tuxcare.6 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 6.2.7 contains no DPoP code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.7-tuxcare.6"
    }
  ]
}