{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:871fc030-51fd-55d5-b20c-b09e62e9cf05",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.4.13-tuxcare.6",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.4.13-tuxcare.6",
      "version": "6.4.13-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.4.13",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.4.13"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.4.13-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:66222234-7f70-5d0e-8e57-5cd35dfea2ab",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 6.4.13-tuxcare.6 of org.springframework.security:spring-security-oauth2-jose. CVE-2018-15801 affects Spring Security 5.1.x prior to 5.1.2. The vulnerability involved JWT issuer validation using Java URL object comparison, which can incorrectly match different issuers due to URL equality semantics. The target (Spring Security 6.4.13) shipped with the upstream fix already applied - the vulnerable URL comparison pattern is not present. The fix (commit 19649db9ce, November 2018) changed validation from URL object comparison to string comparison, and was included in the upstream release that TuxCare onboarded in July 2026.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.4.13-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:607a8585-f408-59e9-9186-25c27152db78",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22748 is fixed in version 6.4.13-tuxcare.6 of org.springframework.security:spring-security-oauth2-jose."
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.4.13-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:06e7cf4b-a5b1-5650-9e6d-b90a3a6b5133",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41707 does not affect version 6.4.13-tuxcare.6 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 6.4.13 contains no DPoP code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.4.13-tuxcare.6"
    }
  ]
}