{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a1c78e39-7e0b-5db8-b2d7-9f4adf98a6f5",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.1.6-tuxcare.8",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.1.6-tuxcare.8",
      "version": "6.1.6-tuxcare.8",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.1.6",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.1.6"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.1.6-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:a7c0476d-b5ed-5726-a179-86ae3bf521cd",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 6.1.6-tuxcare.8 of org.springframework.security:spring-security-oauth2-jose. CVE-2018-15801 affects Spring Security's JWT issuer validation where issuer values were compared using Java's URL.equals() method, which can perform DNS lookups and consider different URL strings equal if they resolve to the same IP. The target Spring Security 6.1.6 contains the upstream fix from November 2018 (commit 19649db9) that changed the comparison to use string equality instead. The current implementation uses a Predicate with string comparison: issuer.equals(claimValue.toString()), which is semantically equivalent to the fix. This is an upstream fix that shipped in the Spring Security 6.1.6 release that TuxCare onboarded, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.1.6-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:3ebcfc74-61f0-55cb-b316-dada46520024",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-22748 is a false positive for org.springframework.security:spring-security-oauth2-jose 6.1.6-tuxcare.8. direct vulnerability is in Spring Security project - affected versions are spring-security-oauth2-jose 6.3.0-6.3.14 / 6.4.0-6.4.14 / 6.5.0-6.5.9 / 7.0.0-7.0.4, version 6.1.6 is not in this range"
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.1.6-tuxcare.8"
        }
      ],
      "bom-ref": "urn:uuid:4a8da6f9-901c-5eb5-9978-7f2b5ccc1e29",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41707 does not affect version 6.1.6-tuxcare.8 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 6.1.6 contains no DPoP code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.1.6-tuxcare.8"
    }
  ]
}