{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c56ebe22-1992-579a-a851-c479b23980f3",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-crypto",
      "purl": "pkg:maven/org.springframework.security/spring-security-crypto@6.3.9-tuxcare.1",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-crypto@6.3.9-tuxcare.1",
      "version": "6.3.9-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-crypto",
            "purl": "pkg:maven/org.springframework.security/spring-security-crypto@6.3.9",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.3.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-22228",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-crypto@6.3.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b24f8e82-1101-537a-b772-995952ac56ed",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-22228 affects version 6.3.9-tuxcare.1 of org.springframework.security:spring-security-crypto."
      }
    },
    {
      "id": "CVE-2025-22234",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-crypto@6.3.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:422e039a-4a38-59cd-b981-50f498742377",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-22234 does not affect version 6.3.9-tuxcare.1 of org.springframework.security:spring-security-crypto. not_affected \u2014 CVE-2025-22234 describes a timing attack vulnerability where the fix for CVE-2025-22228 (which enforced a 72-byte password length limit in BCrypt) inadvertently broke timing attack mitigation during password verification. The target version 6.3.9 is NOT affected because the upstream fix (commit c1aa99fdd2113a232986e9c3a44673ae752de840 by Joe Grandja) was already present in the upstream 6.3.9 re...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47842",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-crypto@6.3.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7bc7f429-3af9-5586-bbd7-6a24eb904839",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-47842 affects version 6.3.9-tuxcare.1 of org.springframework.security:spring-security-crypto, and is fixed in 6.3.9-tuxcare.2."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-crypto@6.3.9-tuxcare.1"
    }
  ]
}