{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a8dd1c02-6a49-5925-a38c-6850b7319539",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.4.3-tuxcare.12",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.4.3-tuxcare.12",
      "version": "6.4.3-tuxcare.12",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.4.3",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.4.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.4.3-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:d34e6bbf-c588-5e33-b229-63b245ff68ad",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 6.4.3-tuxcare.12 of org.springframework.security:spring-security-oauth2-jose. CVE-2018-15801 is NOT present in Spring Security 6.4.3. The vulnerability affected versions 5.1.x prior to 5.1.2 and involved URL object equality comparison in JWT issuer validation, which allowed different issuer strings to be treated as equal due to URL normalization. The fix (commit 19649db9, November 2018) changed issuer validation to use string comparison instead of URL object comparison. This fix was included in Spring Security 5.2.0.M1 and all subsequent versions, including 6.4.3. The target code uses string-based comparison via JwtClaimValidator, preventing issuer confusion attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.4.3-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:b2acc1ad-b1c0-53f6-880c-0686b473f10f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22748 affects version 6.4.3-tuxcare.12 of org.springframework.security:spring-security-oauth2-jose, and is fixed in 6.4.3-tuxcare.13."
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.4.3-tuxcare.12"
        }
      ],
      "bom-ref": "urn:uuid:6e01aa4e-cb7f-5c51-bc92-7b1c734cf280",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41707 does not affect version 6.4.3-tuxcare.12 of org.springframework.security:spring-security-oauth2-jose. CVE-2026-41707 is in DPoPProofJwtDecoderFactory, part of the DPoP support added in Spring Security 6.5. Spring Security 6.4.3 contains no DPoP code, so it is not affected.",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.4.3-tuxcare.12"
    }
  ]
}