{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7e933a63-9758-5c7c-90d2-2f05d4980acd",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-crypto",
      "purl": "pkg:maven/org.springframework.security/spring-security-crypto@6.5.11-tuxcare.3",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-crypto@6.5.11-tuxcare.3",
      "version": "6.5.11-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-crypto",
            "purl": "pkg:maven/org.springframework.security/spring-security-crypto@6.5.11",
            "type": "library",
            "group": "org.springframework.security",
            "version": "6.5.11"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-22228",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-crypto@6.5.11-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:3be8179f-47d3-5e05-88b7-ec7497e07cd0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-22228 affects version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-crypto."
      }
    },
    {
      "id": "CVE-2025-22234",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-crypto@6.5.11-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:35acbf9b-b9c6-5e6a-880e-4ddfaaab5fde",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-22234 does not affect version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-crypto. not_affected \u2014 CVE-2025-22234 is not present in spring-security 6.5.11-tuxcare.4. The vulnerability (timing attack side channel in DaoAuthenticationProvider due to CVE-2025-22228's 72-byte password limit) was fixed by upstream Spring Security maintainer Joe Grandja in commit c1aa99fdd21 (April 17, 2025), which was already included in the upstream 6.5.11 release that TuxCare onboarded. The fix adds a `for_chec...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47842",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-crypto@6.5.11-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:1def30b3-1e5b-579b-b268-ec3fc9f4ae80",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47842 is fixed in version 6.5.11-tuxcare.3 of org.springframework.security:spring-security-crypto."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-crypto@6.5.11-tuxcare.3"
    }
  ]
}