{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:124b74b8-d8ae-53df-a704-0b5cfa9e70eb",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.1.5-tuxcare.1",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.1.5-tuxcare.1",
      "version": "6.1.5-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.1.5",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.1.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.1.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f9db2377-7d70-51e6-b899-78f8d935a30d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 6.1.5-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose. The target Spring Security 6.1.5 does not contain CVE-2018-15801. The vulnerable pattern (URL.equals() comparison during JWT issuer validation) was fixed in upstream commit 19649db9ce by Josh Cummings, which shipped in the 6.1.5 release before TuxCare onboarding. The current implementation uses String.equals() comparison via a Predicate that compares issuer.equals(claimValue.toString()), preventing the issuer validation bypass vulnerability. The MappedJwtClaimSetConverter.convertIssuer() method ensures issuer claims are normalized to Strings using URL.toExternalForm() when needed. This eliminates the URL.equals() quirks that allowed malicious issuer URLs to be incorrectly accepted as matching honest issuer URLs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.1.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:90fb23a1-475d-5b6c-b48e-432a9beb3849",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22748 affects version 6.1.5-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose, and is fixed in 6.1.5-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.1.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ec38ea10-f557-5cda-8344-9b48f6716f38",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41707 affects version 6.1.5-tuxcare.1 of org.springframework.security:spring-security-oauth2-jose."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.1.5-tuxcare.1"
    }
  ]
}