{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:bb01e791-8409-5a24-8631-aa05ab222a76",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.5.8-tuxcare.5",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.5.8-tuxcare.5",
      "version": "5.5.8-tuxcare.5",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.5.8",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.5.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.5.8-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:044aef2d-0bf2-5042-87f1-805e12166278",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 5.5.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose. Spring Security 5.5.8 is not affected by CVE-2018-15801. The vulnerability required URL object comparison for JWT issuer validation, which allowed different issuer URLs to be treated as equivalent due to URL.equals() semantics (DNS resolution, port normalization). The target code uses string comparison instead: MappedJwtClaimSetConverter converts issuer claims to String via URL.toExternalForm(), and JwtIssuerValidator compares using issuer.equals(claimValue.toString()). This fix was authored by josh.cummings@gmail.com in commit 19649db9ce (2018-11-13) and was already present in upstream Spring Security 5.5.8 when TuxCare onboarded it in commit 8cf3277976.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.5.8-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:178e7636-88e7-50f0-b9d7-73eded05e322",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22748 does not affect version 5.5.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 5.5.8 is not affected by CVE-2026-22748. The vulnerability concerns the builder methods NimbusJwtDecoder.withIssuerLocation() and NimbusReactiveJwtDecoder.withIssuerLocation(), which do not exist in version 5.5.8. These methods were introduced in Spring Security 6.1.0-RC1 (commit 76eba9bd0c, April 2023), approximately 7196 commits after version 5.5.8. Version 5.5.8 provides equi...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.5.8-tuxcare.5"
        }
      ],
      "bom-ref": "urn:uuid:070bd89e-91aa-5b0a-9449-f9e06c49789b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41707 does not affect version 5.5.8-tuxcare.5 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 5.5.8 contains no DPoP code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.5.8-tuxcare.5"
    }
  ]
}