{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6e5ea118-9cc1-5d70-8ea7-b2995c053035",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.3",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.3",
      "version": "6.0.7-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.0.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:5870f4d1-9233-5b9a-88c8-51b07d60f1b1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 6.0.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose. CVE-2018-15801 is NOT present in Spring Security 6.0.7-tuxcare.2. The vulnerability involved using Java URL object equality for JWT issuer validation, which performs DNS resolution and could allow different issuer strings resolving to the same host to be treated as equal. The upstream fix (commit 19649db9ce by Josh Cummings) changed to string-based comparison and was already included in Spring Security 6.0.7 when TuxCare onboarded it. The current code uses string comparison via issuer.equals(claimValue.toString()), preventing the DNS-based bypass. The vulnerable pattern is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:92fd040e-c48c-5721-bf91-9ae2bcbf1b99",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22748 does not affect version 6.0.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose. not_affected \u2014 Spring Security 6.0.7 is not affected by CVE-2026-22748. The vulnerable method `NimbusJwtDecoder.withIssuerLocation()` does not exist in this version - it was introduced later in Spring Security 6.1.0 (commit 76eba9bd0c). The target only contains the safe factory method `JwtDecoders.fromIssuerLocation()` which properly includes issuer validation.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:f72b0f98-ce7b-59e2-8d5a-14ad4fa8c203",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41707 does not affect version 6.0.7-tuxcare.3 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 6.0.7 contains no DPoP code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.0.7-tuxcare.3"
    }
  ]
}