{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8fcd3a54-594a-5579-aaea-2fc5b8186b1d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-saml2-service-provider",
      "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.5.11-tuxcare.5",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.5.11-tuxcare.5",
      "version": "6.5.11-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-saml2-service-provider",
            "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.5.11",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.5.11"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-40988",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.5.11-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:1104feb5-4230-5857-8f42-2f0453d1e663",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40988 does not affect version 6.5.11-tuxcare.5 of org.springframework.security:spring-security-saml2-service-provider. CVE-2026-40988 is NOT present in Spring Security 6.5.11. The upstream vendor fix (commit 9d4d9065b4 by Josh Cummings) was included in the Spring Security 6.5.11 release, which TuxCare onboarded. The CappedOutputStream defense that limits SAML payload inflation to 1MB is present in all 8 Saml2Utils.java files. The vulnerable unbounded inflation pattern does not exist in this version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-40993",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.5.11-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:53b62241-52e7-5d5b-a718-4dcf6d15eb08",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40993 does not affect version 6.5.11-tuxcare.5 of org.springframework.security:spring-security-saml2-service-provider. Spring Security 6.5.11 is not affected by CVE-2026-40993. The vulnerable class JdbcAssertingPartyMetadataRepository was introduced in Spring Security 7.0.0 (June 2025) and does not exist in version 6.5.11. Exhaustive searches confirm no JDBC-based SAML2 metadata repository implementation exists in this version. The only repository implementations are in-memory, HTTP session-based, and OpenSAML-based, none of which deserialize credentials from a database.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41003",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.5.11-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:dcc5c0d8-5958-5379-b5e6-7cc7286ab865",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41003 does not affect version 6.5.11-tuxcare.5 of org.springframework.security:spring-security-saml2-service-provider. Spring Security 6.5.11 is not vulnerable as it is equal to upstream fix version - 6.5.11",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41694",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.5.11-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:ddd60ffb-59c2-58a5-9b7e-277212110268",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41694 does not affect version 6.5.11-tuxcare.5 of org.springframework.security:spring-security-saml2-service-provider. not_affected - Spring Security 6.5.11 contains the complete upstream fix for CVE-2026-41694: the signature is validated before decryption in BaseOpenSamlAuthenticationProvider and both logout validators. Fix commit cf0687120024 was authored AND committed by upstream maintainer Josh Cummings on 2026-04-30 and is already an ancestor of upstream Release 6.5.11 (73b077790fcb), which is the parent of our onboarding commit. No CloudLinux backport for this CVE exists on tuxcare-current/6.5.11. Corrected from already_fixed, see IRER-1226.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.5.11-tuxcare.5"
    }
  ]
}