{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3e8406ea-ac89-5522-81da-9f3b2d4b5686",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-security-oauth2-authorization-server",
      "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.2",
      "type": "library",
      "group": "org.springframework.security",
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.2",
      "version": "1.5.8-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-security-oauth2-authorization-server",
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8",
            "type": "library",
            "group": "org.springframework.security",
            "version": "1.5.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2024-22258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e6dacc7a-8927-5fdf-b46c-89f308464de1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22258 affects version 1.5.8-tuxcare.2 of org.springframework.security:spring-security-oauth2-authorization-server."
      }
    },
    {
      "id": "CVE-2026-22752",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:971f0788-100f-5712-8381-6f2d57f757cc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22752 affects version 1.5.8-tuxcare.2 of org.springframework.security:spring-security-oauth2-authorization-server."
      }
    },
    {
      "id": "CVE-2026-41008",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:20106de9-7005-5462-964e-0ef51d9f8997",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41008 does not affect version 1.5.8-tuxcare.2 of org.springframework.security:spring-security-oauth2-authorization-server. Spring Authorization Server 1.5.8 is not vulnerable as it is higher than upstream fix version - 1.5.7.1",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47877",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2f5e7f0d-351b-5c78-9d97-51711153c7f4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-47877 affects version 1.5.8-tuxcare.2 of org.springframework.security:spring-security-oauth2-authorization-server."
      }
    },
    {
      "id": "CVE-2026-59316",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1609f0db-9b5b-56b8-9050-9a605b17bbc7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59316 affects version 1.5.8-tuxcare.2 of org.springframework.security:spring-security-oauth2-authorization-server."
      }
    },
    {
      "id": "CVE-2026-59354",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4c399e61-bd40-5c66-a23b-d9ff6416a121",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59354 affects version 1.5.8-tuxcare.2 of org.springframework.security:spring-security-oauth2-authorization-server."
      }
    },
    {
      "id": "CVE-2026-59355",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:584947db-505a-5d04-8a26-1ce565efb86a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-59355 does not affect version 1.5.8-tuxcare.2 of org.springframework.security:spring-security-oauth2-authorization-server. not_affected \u2014 The target Spring Authorization Server version 1.5.8-tuxcare.3 is NOT AFFECTED by CVE-2026-59355. The vulnerability was fixed in upstream commit 381b1493 (\"Polish redirect flows\") authored by Joe Grandja, which was already present in the Spring Authorization Server 1.5.8 release when TuxCare onboarded it. All three components of the fix are present in HEAD: (1) parameter extraction is prevented...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.2"
    }
  ]
}