{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:9ce1998c-21ba-5fbf-b536-9c26b56aa541",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.9-tuxcare.4",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.9-tuxcare.4",
      "version": "6.3.9-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.9",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.3.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:7385edd4-d04a-593d-bce2-dca8ba01e410",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 6.3.9-tuxcare.4 of org.springframework.security:spring-security-oauth2-jose. CVE-2018-15801 is NOT present in Spring Security 6.3.9-tuxcare.2. The vulnerability involved using Java's URL.equals() method for JWT issuer validation, which can be exploited due to DNS resolution behavior. The upstream vendor (Spring Security) fixed this in commit 19649db9ce (authored by Josh Cummings) by converting to string-based comparison. This fix was already present in the upstream 6.3.9 release that TuxCare onboarded. The current code uses JwtClaimValidator with a Predicate that performs safe string comparison (issuer.equals(claimValue.toString())), completely avoiding the vulnerable URL.equals() pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:6dfb39cc-4a07-5f4a-9bbe-6871fd50ca95",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22748 is fixed in version 6.3.9-tuxcare.4 of org.springframework.security:spring-security-oauth2-jose."
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.9-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ed048e51-d02d-5849-ab26-66fc84319ea9",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41707 does not affect version 6.3.9-tuxcare.4 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 6.3.9 contains no DPoP code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.3.9-tuxcare.4"
    }
  ]
}