{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:1ee1a36d-d53e-5238-8398-c3e7d7aa5b1c",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-saml2-service-provider",
      "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.3-tuxcare.13",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.3-tuxcare.13",
      "version": "6.4.3-tuxcare.13",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-saml2-service-provider",
            "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.3",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.4.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-40988",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.3-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:e7cd023a-d479-5ba0-8f5f-32ac76113f7d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-40988 is fixed in version 6.4.3-tuxcare.13 of org.springframework.security:spring-security-saml2-service-provider."
      }
    },
    {
      "id": "CVE-2026-40993",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.3-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:8a8e9132-b785-5003-a3d3-6515f7af8db2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40993 does not affect version 6.4.3-tuxcare.13 of org.springframework.security:spring-security-saml2-service-provider. Spring Security 6.4.3 is not affected by CVE-2026-40993. The vulnerable component JdbcAssertingPartyMetadataRepository does not exist in this version. This class and the associated JDBC-based SAML2 asserting party metadata repository feature was introduced in Spring Security 7.0.0. Version 6.4.3 contains no code that deserializes credentials from database columns, no JDBC integration in the SAML2 module, and no database schema for storing SAML2 asserting party metadata. The vulnerability pattern (insecure Java object deserialization of credentials from database) is completely absent from the codebase.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41003",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.3-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:1e746438-055f-5afd-988d-86e18e9aa500",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41003 is fixed in version 6.4.3-tuxcare.13 of org.springframework.security:spring-security-saml2-service-provider."
      }
    },
    {
      "id": "CVE-2026-41694",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.3-tuxcare.13"
        }
      ],
      "bom-ref": "urn:uuid:0ead217f-48e1-5c19-939a-4a2837daeb0d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41694 is fixed in version 6.4.3-tuxcare.13 of org.springframework.security:spring-security-saml2-service-provider."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.4.3-tuxcare.13"
    }
  ]
}