{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:17ebabd5-c0c0-52fd-ac2d-9b1ddcfb4d38",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.5-tuxcare.3",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.5-tuxcare.3",
      "version": "5.6.5-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.5",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.6.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.5-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:c591e214-66e4-524e-8357-c5d60b9b56d4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 5.6.5-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose. Spring Security 5.6.5 is not affected by CVE-2018-15801. The vulnerability, which involved comparing JWT issuer claims as URL objects (allowing bypass via URL normalization/resolution), was fixed in upstream Spring Security 5.1.2. The target version 5.6.5 already contains the upstream fix that compares issuer claims as strings. The fix commit (19649db9ce \"Leave Issuer As String\" by josh.cummings@gmail.com) was part of the upstream 5.6.5 release that TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.5-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:a508b9fe-d930-5d76-a084-b64b85d89ca5",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22748 does not affect version 5.6.5-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Version 5.6.5 is not affected by CVE-2026-22748. The vulnerability is specifically about the NimbusJwtDecoder.withIssuerLocation() and NimbusReactiveJwtDecoder.withIssuerLocation() methods, which were introduced in Spring Security 6.1.0 (April 2023) and do not exist in version 5.6.5. TuxCare backports of this CVE exist only for 6.x versions (6.2.7, 6.2.8, 6.3.9, 6.4.13), confirming that 5.x ver...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.5-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:ef6e3acf-7e5b-52af-ad65-235b32334c1e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41707 affects version 5.6.5-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@5.6.5-tuxcare.3"
    }
  ]
}