{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:80228201-21e5-54e5-9ff1-d79fed91e702",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-saml2-service-provider",
      "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.0.7-tuxcare.1",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.0.7-tuxcare.1",
      "version": "6.0.7-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-saml2-service-provider",
            "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.0.7",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.0.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-40988",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.0.7-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:81a55b98-50cd-593b-83ef-f22cf326157e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-40988 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-saml2-service-provider."
      }
    },
    {
      "id": "CVE-2026-40993",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.0.7-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0c78fef2-35bf-5be7-8925-7cdbbf8c81e1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40993 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-saml2-service-provider. Spring Security 6.0.7 is not affected by CVE-2026-40993. The vulnerable component JdbcAssertingPartyMetadataRepository does not exist in this version. This class, which performs insecure deserialization of SAML2 credentials from database columns, was introduced in Spring Security 7.0.0 (May 2025 upstream). Version 6.0.7 uses only in-memory SAML2 repository patterns (InMemoryRelyingPartyRegistrationRepository) without any database deserialization functionality. The vulnerability is specific to the JDBC-based asserting party metadata repository feature added in 7.x series.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41003",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.0.7-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:139925f7-6c51-5c1a-acf3-0b5d6c6aa9f4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41003 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-saml2-service-provider."
      }
    },
    {
      "id": "CVE-2026-41694",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.0.7-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b3aeb35a-f83b-5b61-bd23-d68bac0a33a4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41694 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-saml2-service-provider."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.0.7-tuxcare.1"
    }
  ]
}