{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8ddd545e-c3ff-5f3a-a3a5-2cf0ae829554",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-saml2-service-provider",
      "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.7.6-tuxcare.1",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.7.6-tuxcare.1",
      "version": "5.7.6-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-saml2-service-provider",
            "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.7.6",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.7.6"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-40988",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.7.6-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b041541a-cbf6-5105-bb62-a83fe05e4887",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-40988 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-saml2-service-provider, and is fixed in 5.7.6-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-40993",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.7.6-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1dff299b-90da-5aa7-96d2-0b7e29b585b3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40993 does not affect version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-saml2-service-provider. Prechecker: No vulnerable code from the fix was found; the vulnerable lines are absent, and this version declares none of the classes the fix changes. Version 5.7.6 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-2q7c-5gjm-7q23 (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41003",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.7.6-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0e544ff6-c1cf-5fb7-86c8-449e79107220",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41003 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-saml2-service-provider, and is fixed in 5.7.6-tuxcare.2."
      }
    },
    {
      "id": "CVE-2026-41694",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.7.6-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:31106b86-2b4c-504f-bd30-97d93524df2d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41694 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-saml2-service-provider, and is fixed in 5.7.6-tuxcare.2."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.7.6-tuxcare.1"
    }
  ]
}