{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:54875e07-3815-57ff-8772-7520dbdda9e1",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-saml2-service-provider",
      "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.0.8-tuxcare.4",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.0.8-tuxcare.4",
      "version": "6.0.8-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-saml2-service-provider",
            "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.0.8",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.0.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-40988",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.0.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:28c59f21-f8a8-52df-a49b-07fb2f1c4ae4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-40988 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider."
      }
    },
    {
      "id": "CVE-2026-40993",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.0.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:5549261f-697e-5faf-900e-264bfdb4a54d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40993 does not affect version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider. Spring Security 6.0.8 is not affected by CVE-2026-40993. The vulnerable component JdbcAssertingPartyMetadataRepository does not exist in this version. Both the class and its parent interface AssertingPartyMetadataRepository were introduced in version 6.4.0 (July 2024), significantly after the target version 6.0.8. The SAML2 module in 6.0.8 uses only in-memory repositories with no JDBC-based persistence for metadata, eliminating the attack surface described in the CVE.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41003",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.0.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:f3ab19f0-a7bf-58b0-bc44-abfa11f4cf61",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41003 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider."
      }
    },
    {
      "id": "CVE-2026-41694",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.0.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:e54ac4fd-24e2-5d16-910a-3faf43368c9f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41694 is fixed in version 6.0.8-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.0.8-tuxcare.4"
    }
  ]
}