{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c5953834-a146-5bc5-bdd9-d7be2dedbeb0",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.3",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.3",
      "version": "5.1.6.RELEASE-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.1.6.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:35025f38-0cfb-52ce-9d20-7281bbc7e224",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose. CVE-2018-15801 affects Spring Security 5.1.x prior to 5.1.2. The target version 5.1.6.RELEASE-tuxcare.2 is after 5.1.2 and contains the upstream fix. The vulnerability involved URL.equals() performing DNS resolution, allowing different issuer URLs resolving to the same IP to be considered equivalent. The fix changed issuer validation from URL object comparison to String comparison. Both JwtIssuerValidator.java and MappedJwtClaimSetConverter.java show the fixed code: issuer is stored as String (not URL) and compared using String.equals(). The fix was authored by upstream Spring Security maintainer Josh Cummings and was already present in the upstream 5.1.6.RELEASE when TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:f71acf11-4744-5e42-951a-eea73ce2401c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22748 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 5.1.6.RELEASE is not affected by CVE-2026-22748. The vulnerability concerns the `withIssuerLocation` method in NimbusJwtDecoder and NimbusReactiveJwtDecoder, which creates confusion because it accepts an issuer parameter but does not automatically add issuer validation. This method does not exist in version 5.1.6.RELEASE - it was introduced in later versions (5.7+) in April 2023...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:f87bcd1f-e422-5264-bf55-0ba50b0baa14",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41707 does not affect version 5.1.6.RELEASE-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 5.1.6.RELEASE contains no DPoP code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.1.6.RELEASE-tuxcare.3"
    }
  ]
}