{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0dd14fc5-0db8-546c-8cb8-b7960a19063c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.3-tuxcare.2",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.3-tuxcare.2",
      "version": "5.6.3-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.3",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.6.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:207e4e20-70a8-523f-97fd-55b77117b9ee",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 5.6.3-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. CVE-2018-15801 affects Spring Security 5.1.x prior to 5.1.2. The target is version 5.6.3, which already contains the upstream vendor's fix (commit 19649db9ce by Josh Cummings). The vulnerable pattern\u2014Java URL object comparison in JWT issuer validation\u2014is not present. The target code converts issuers to strings before comparison (via MappedJwtClaimSetConverter.convertIssuer() and JwtIssuerValidator using string comparison), matching the security fix exactly. This fix shipped with the upstream Spring Security 5.6.3 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:30b4f460-47ca-5754-a36c-03562bf65371",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22748 does not affect version 5.6.3-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 5.6.3 is not affected by CVE-2026-22748. The vulnerability concerns the NimbusJwtDecoder.withIssuerLocation() and NimbusReactiveJwtDecoder.withIssuerLocation() methods that fail to automatically configure issuer validation. These methods were introduced in version 6.1.0 and do not exist in 5.6.3. Version 5.6.3 has a different method (JwtDecoders.fromIssuerLocation()) which corre...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:dbb0a679-31bb-55be-a3c8-84b77e4eeabf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41707 affects version 5.6.3-tuxcare.2 of org.springframework.security:spring-security-oauth2-jose."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.3-tuxcare.2"
    }
  ]
}