{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:89725395-6ac1-58a4-a457-d022b954a3ba",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-jose",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.5.11-tuxcare.4",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.5.11-tuxcare.4",
      "version": "6.5.11-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-jose",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.5.11",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.5.11"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-15801",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.5.11-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:a1fc5e2d-3e87-5ca1-a29f-a0213263df05",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-15801 does not affect version 6.5.11-tuxcare.4 of org.springframework.security:spring-security-oauth2-jose. CVE-2018-15801 is NOT present in the target repository. The vulnerability involved using Java's URL.equals() method for JWT issuer validation, which performs DNS resolution and could allow different issuer URL strings to be treated as equivalent if they resolve to the same IP address. The fix (commit 19649db9ce, November 13, 2018) converted issuer validation from URL object comparison to string comparison. This fix was already present in the upstream Spring Security 6.5.11 release that TuxCare onboarded. The current code uses string-based comparison via issuer.equals(claimValue.toString()) and contains no URL object equality checks in the issuer validation path.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.1.0, < 5.1.2; >= 5.1.0, < 5.1.2), cve.org (>= 5.1.x, < 5.1.2), Snyk (>= 5.1.0, < 5.1.2.RELEASE).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-22748",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.5.11-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ef817f84-d443-5ff5-be65-9ba725de2f11",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22748 does not affect version 6.5.11-tuxcare.4 of org.springframework.security:spring-security-oauth2-jose. already_fixed \u2014 The target repository (Spring Security 6.5.11) already contains the vendor fix for CVE-2026-22748. The fix commits (68b820ed09 and 835d6c1fbd) are present in the repository's git history and are ancestors of the current version (d28d39bc5b). The code implements automatic issuer validation when using NimbusJwtDecoder.withIssuerLocation() and NimbusReactiveJwtDecoder.withIssuerLocation(), prevent...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41707",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.5.11-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:a22aa1e7-5acb-5cab-95e0-d698186e7c1c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41707 is fixed in version 6.5.11-tuxcare.4 of org.springframework.security:spring-security-oauth2-jose."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-jose@6.5.11-tuxcare.4"
    }
  ]
}