{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b4808a4e-2e76-53c3-bab9-1d7bc4881c09",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.20",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.20",
      "version": "6.3.10-tuxcare.20",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.3.10"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.20"
        }
      ],
      "bom-ref": "urn:uuid:a8431731-7c6c-5821-a5c3-abbd5301415f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-oauth2-jose. CVE-2018-15801 affects Spring Security 5.1.x prior to 5.1.2 due to JWT issuer validation using Java's URL.equals() method, which can treat different URL strings as equivalent through normalization. The target version 6.3.10 is NOT affected because the upstream fix (commit 19649db9ce \"Leave Issuer As String\") was already present in the upstream release that TuxCare onboarded. The fix refactored issuer validation to use string comparison instead of URL.equals(), eliminating the vulnerability. No TuxCare backport was needed as the fix shipped with the original upstream version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.20"
        }
      ],
      "bom-ref": "urn:uuid:f04cd1b3-226b-5710-af18-77ed589afa8a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22748 affects version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-oauth2-jose, and is fixed in 6.3.10-tuxcare.23."
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.20"
        }
      ],
      "bom-ref": "urn:uuid:4f3c911c-b1dd-5918-9149-7a96f7031d9e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41707 does not affect version 6.3.10-tuxcare.20 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 6.3.10 contains no DPoP code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.10-tuxcare.20"
    }
  ]
}