{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:29210f7e-ec9c-589d-b9c4-9abb7c51477f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-saml2-service-provider",
      "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.8",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.8",
      "version": "6.2.8-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-saml2-service-provider",
            "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.2.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-40988",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:be44b941-e6b4-5762-a3e1-77ca9da5cb9d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-40988 is fixed in version 6.2.8-tuxcare.8 of org.springframework.security:spring-security-saml2-service-provider."
      }
    },
    {
      "id": "CVE-2026-40993",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:e613fb5e-06c8-5ce4-ae1a-b49232caefd3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40993 does not affect version 6.2.8-tuxcare.8 of org.springframework.security:spring-security-saml2-service-provider. Spring Security 6.2.8 is not affected by CVE-2026-40993. The vulnerable component JdbcAssertingPartyMetadataRepository does not exist in this version. The CVE specifically affects Spring Security 7.0.0 - 7.0.5, where the JDBC-based SAML2 asserting party metadata repository was introduced. Version 6.2.8 only contains in-memory and HTTP session-based SAML2 repositories, with no JDBC-based implementation for asserting party metadata storage. The vulnerability pattern (unsafe deserialization of credentials from database columns) cannot manifest because the affected code path does not exist in this version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41003",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:0957aa38-151b-5bf4-b88e-3383aa48ccd8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41003 is fixed in version 6.2.8-tuxcare.8 of org.springframework.security:spring-security-saml2-service-provider."
      }
    },
    {
      "id": "CVE-2026-41694",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:77373d04-044b-50c9-b192-85df7e6e4e1a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41694 is fixed in version 6.2.8-tuxcare.8 of org.springframework.security:spring-security-saml2-service-provider."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.8-tuxcare.8"
    }
  ]
}