{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f4764059-e475-5742-84e1-186cda286428",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.7",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.7",
      "version": "6.2.8-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.2.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:ece33510-b80c-55e6-ba55-66332c10f7a6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose. The target Spring Security 6.2.8-tuxcare.6 is not vulnerable to CVE-2018-15801. This CVE affects versions 5.1.x prior to 5.1.2 and involves an authorization bypass during JWT issuer validation when URL object equality was used instead of string comparison. The target version includes the fix that was applied in upstream Spring Security between 2018-2020, which ensures issuer validation uses string comparison. The fix is implemented through MappedJwtClaimSetConverter.convertIssuer() converting issuer claims to strings (using URL.toExternalForm() when needed) and JwtIssuerValidator using string equality via .toString() for comparison. This fix was already present in the upstream 6.2.8 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:3c8d7c09-324d-5cbe-a710-c99b9c9ffaa9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22748 is fixed in version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose."
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:cfc3d48f-7ff9-5a07-9c67-65b6d1c436e3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41707 does not affect version 6.2.8-tuxcare.7 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 6.2.8 contains no DPoP code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.2.8-tuxcare.7"
    }
  ]
}