{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a02cdbb9-cf83-5975-8fc2-21567c438199",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-saml2-service-provider",
      "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.5.8-tuxcare.4",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.5.8-tuxcare.4",
      "version": "5.5.8-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-saml2-service-provider",
            "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.5.8",
            "type": "library",
            "group": "org.springframework.security",
            "version": "5.5.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-40988",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.5.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:39c79cd4-6e22-5717-bb12-00e098cfde14",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-40988 is fixed in version 5.5.8-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider."
      }
    },
    {
      "id": "CVE-2026-40993",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.5.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:19b1e6c0-e1bc-5418-8f32-dbab7532c2b6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40993 does not affect version 5.5.8-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider. Spring Security 5.5.8 is not affected by CVE-2026-40993. The vulnerable class JdbcAssertingPartyMetadataRepository and the entire JDBC-backed SAML2 repository feature do not exist in this version. The SAML2 module in 5.5.8 only supports in-memory storage via InMemoryRelyingPartyRegistrationRepository, with no database persistence, no credential deserialization, and no path for the attack vector described in the CVE. The vulnerable feature was introduced in Spring Security 7.0.0.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41003",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.5.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ac4a0eec-623e-56eb-bfaf-78c3e1b4d224",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41003 is fixed in version 5.5.8-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider."
      }
    },
    {
      "id": "CVE-2026-41694",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.5.8-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:a735118f-8000-5df7-b600-14e343a5aee8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41694 is fixed in version 5.5.8-tuxcare.4 of org.springframework.security:spring-security-saml2-service-provider."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@5.5.8-tuxcare.4"
    }
  ]
}