{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b3e3055d-d3e8-51f4-9b45-82176f61f391",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.5.RELEASE-tuxcare.2",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.5.RELEASE-tuxcare.2",
      "version": "5.1.5.RELEASE-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.5.RELEASE",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.1.5.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.5.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0377035d-ef14-5e16-a6fa-ca223780c9da",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. The target Spring Security 5.1.5.RELEASE-tuxcare.1 is not affected by CVE-2018-15801. The vulnerability (JWT issuer validation bypass via URL object comparison) was fixed in upstream Spring Security 5.1.2.RELEASE (November 2018) and the fix was already present in the upstream 5.1.5.RELEASE (April 2019) when TuxCare onboarded it. The vulnerable code pattern does not exist in the target. Fix authored by upstream developer josh.cummings@gmail.com in commit 5478b74116.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.5.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5eeb35e2-632c-5026-b547-564e2a3fee27",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22748 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Version 5.1.5.RELEASE is not affected by CVE-2026-22748. The vulnerability concerns the `NimbusJwtDecoder.withIssuerLocation()` and `NimbusReactiveJwtDecoder.withIssuerLocation()` methods that were introduced in later versions. This older version (from 2018) does not have these methods. The equivalent functionality that exists in 5.1.5 (`JwtDecoders.fromOidcIssuerLocation()` and `ReactiveJwtDec...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.5.RELEASE-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6726940d-5faf-5133-901c-96f0cd076835",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41707 does not affect version 5.1.5.RELEASE-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 5.1.5.RELEASE contains no DPoP code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.5.RELEASE-tuxcare.2"
    }
  ]
}