{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4141e156-5177-5e97-a413-911a50f9e3d9",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-saml2-service-provider",
      "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.7-tuxcare.8",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.7-tuxcare.8",
      "version": "6.2.7-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-saml2-service-provider",
            "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.7",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.2.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-40988",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.7-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:b3756264-6404-5405-ac80-f469a9ac15b4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-40988 is fixed in version 6.2.7-tuxcare.8 of org.springframework.security:spring-security-saml2-service-provider."
      }
    },
    {
      "id": "CVE-2026-40993",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.7-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:c2ba5818-7634-538a-a201-b4cd07f55407",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40993 does not affect version 6.2.7-tuxcare.8 of org.springframework.security:spring-security-saml2-service-provider. Spring Security 6.2.7 is NOT AFFECTED by CVE-2026-40993. The vulnerable class `JdbcAssertingPartyMetadataRepository` and the entire asserting party metadata repository feature do not exist in this version. The feature was introduced in Spring Security 6.4.0 (July 2024), which is newer than the target version 6.2.7. The CVE affects versions 7.0.0 - 7.0.5. The SAML2 module in 6.2.7 has no JDBC-based repositories and no code that deserializes credentials from database columns.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41003",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.7-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:aaf410b7-0f27-5e25-b717-87714dcaf3c8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41003 is fixed in version 6.2.7-tuxcare.8 of org.springframework.security:spring-security-saml2-service-provider."
      }
    },
    {
      "id": "CVE-2026-41694",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.7-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:7ebdfa76-c76b-5dae-8a14-6c8dfc8cda91",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41694 is fixed in version 6.2.7-tuxcare.8 of org.springframework.security:spring-security-saml2-service-provider."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.7-tuxcare.8"
    }
  ]
}