{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b4f5b3bb-24dd-5a0a-b8ba-75dc99378479",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-saml2-service-provider",
      "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.2-tuxcare.10",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.2-tuxcare.10",
      "version": "6.2.2-tuxcare.10",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-saml2-service-provider",
            "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.2",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.2.2"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-40988",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.2-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:3c0a5c71-de10-5467-bc2a-b5102503f658",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-40988 is fixed in version 6.2.2-tuxcare.10 of org.springframework.security:spring-security-saml2-service-provider."
      }
    },
    {
      "id": "CVE-2026-40993",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.2-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:71668939-9c7f-5234-8094-44a28353f49a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40993 does not affect version 6.2.2-tuxcare.10 of org.springframework.security:spring-security-saml2-service-provider. Spring Security 6.2.2 is not affected by CVE-2026-40993. The vulnerable class JdbcAssertingPartyMetadataRepository and the entire JDBC-based SAML2 asserting party metadata persistence feature do not exist in this version. This feature was introduced in Spring Security 7.0.0, which is newer than the target version. The CVE affects only versions 7.0.0 through 7.0.5.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41003",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.2-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:f54d5a2e-9dd2-5d94-9b3d-85fa71a9e72e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41003 is fixed in version 6.2.2-tuxcare.10 of org.springframework.security:spring-security-saml2-service-provider."
      }
    },
    {
      "id": "CVE-2026-41694",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.2-tuxcare.10"
        }
      ],
      "bom-ref": "urn:uuid:c44902e2-b2de-56cb-99e5-ec96dcc60b0a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41694 is fixed in version 6.2.2-tuxcare.10 of org.springframework.security:spring-security-saml2-service-provider."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.2-tuxcare.10"
    }
  ]
}