{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ad004d03-c839-57bb-ac9a-280a996ce11c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-saml2-service-provider",
      "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.1.5-tuxcare.3",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.1.5-tuxcare.3",
      "version": "6.1.5-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-saml2-service-provider",
            "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.1.5",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.1.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-40988",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.1.5-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:976d5212-1de4-53fd-bce9-59cb0a9bcda8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-40988 is fixed in version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider."
      }
    },
    {
      "id": "CVE-2026-40993",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.1.5-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:8fdeb33a-4f3f-5bf0-845c-8d7e656fb60f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40993 does not affect version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider. Prechecker: No vulnerable code from the fix was found, and none of the identifiers of the vulnerable code exist in this version. Version 6.1.5 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-2q7c-5gjm-7q23 (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41003",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.1.5-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:96d86583-6b32-5e07-97ba-e3077185baf8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41003 is fixed in version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider."
      }
    },
    {
      "id": "CVE-2026-41694",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.1.5-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:c6a676ec-3957-5fc9-a1cb-c4e40c01c44f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41694 is fixed in version 6.1.5-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.1.5-tuxcare.3"
    }
  ]
}