{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c0ab1831-0b73-51c0-b3da-2e56431c6dc8",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.1",
      "type": "library",
      "group": "org.springframework.security",
      "name": "spring-security-data",
      "version": "6.0.8-tuxcare.1",
      "purl": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:2656539b-5d99-50ba-ac07-6e214081752f",
      "id": "CVE-2023-34042",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34042 does not affect version 6.0.8-tuxcare.1 of org.springframework.security:spring-security-data. not_affected \u2014 CVE-2023-34042 is NOT present in the target. The upstream vendor fix (commit 5b293d21161e946bf241d9e974b9af93cfafaaac by Rob Winch) has already been applied to version 6.0.8. The vulnerable symlink at config/src/main/resources/org/springframework/security/config/spring-security.xsd has been removed, and the secure build-time file generation mechanism (CreateVersionlessXsdTask) is properly imple..."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:ec91ea03-ba59-5ebd-ad1a-2c19e00faff9",
      "id": "CVE-2024-22257",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22257 is fixed in version 6.0.8-tuxcare.1 of org.springframework.security:spring-security-data."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a3b1651d-ffd4-56d6-bedd-f2b146711144",
      "id": "CVE-2024-38821",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38821 is fixed in version 6.0.8-tuxcare.1 of org.springframework.security:spring-security-data."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3a31f0a4-48eb-5584-ab60-ea48a7a9785d",
      "id": "CVE-2024-38827",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38827 affects version 6.0.8-tuxcare.1 of org.springframework.security:spring-security-data."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f476760e-db63-57b6-8e04-a91859f32e83",
      "id": "CVE-2025-22228",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-22228 is fixed in version 6.0.8-tuxcare.1 of org.springframework.security:spring-security-data."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:985dd761-0584-54b6-a628-084a519f96c3",
      "id": "CVE-2025-22234",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-22234 affects version 6.0.8-tuxcare.1 of org.springframework.security:spring-security-data."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9439045a-5d97-58e3-86ce-22b241f5cfe5",
      "id": "CVE-2026-22732",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22732 affects version 6.0.8-tuxcare.1 of org.springframework.security:spring-security-data."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:30539373-d6f7-5cf0-95f0-8f96b0262cdd",
      "id": "CVE-2026-22746",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22746 affects version 6.0.8-tuxcare.1 of org.springframework.security:spring-security-data."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:a2c86860-511a-5813-869f-3eee8b2ee623",
      "id": "CVE-2026-22747",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-22747 affects version 6.0.8-tuxcare.1 of org.springframework.security:spring-security-data."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:65af56c8-22c1-5c6a-a326-81a879d9e845",
      "id": "CVE-2026-22748",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22748 does not affect version 6.0.8-tuxcare.1 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security version 6.0.8 is not affected by CVE-2026-22748. The vulnerability concerns the NimbusJwtDecoder.withIssuerLocation() and NimbusReactiveJwtDecoder.withIssuerLocation() builder methods failing to automatically validate JWT issuer claims. These methods do not exist in version 6.0.8 - they were introduced in version 6.1.0, approximately 225 commits after the 6.0.8 release."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:248a1f7f-2291-58ca-b55f-071b5be1ee01",
      "id": "CVE-2026-22753",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22753 does not affect version 6.0.8-tuxcare.1 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-22753. The vulnerability requires PathPatternRequestMatcher and PathPatternRequestMatcher.Builder components that were introduced in Spring Security 7.0.0 and do not exist in version 6.0.8. The target version uses different request matching implementations (MvcRequestMatcher, AntPathRequestMatcher) that predate the vulnerable architecture."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3dd88cb1-7eaa-57c6-9a7f-1ab7c3910d31",
      "id": "CVE-2026-22754",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22754 does not affect version 6.0.8-tuxcare.1 of org.springframework.security:spring-security-data. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcher (introduced in Spring Security 7.0) where basePath configuration is not properly applied. Version 6.0.8 uses MvcRequestMatcher for servlet-path support, which correctly implements the servletPath check and does not have the builder reassignment bug. The vulnerable code patterns from bo..."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7e5e67bf-5ddf-5884-b72b-d53ecc3e2ca1",
      "id": "CVE-2026-40988",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-40988 affects version 6.0.8-tuxcare.1 of org.springframework.security:spring-security-data."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b90ec4c7-2b53-59bf-bb55-c1bb53240b0d",
      "id": "CVE-2026-40993",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-40993 affects version 6.0.8-tuxcare.1 of org.springframework.security:spring-security-data."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f9a6b670-fae5-5ad2-a5b2-37c750b2eb4c",
      "id": "CVE-2026-41003",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41003 affects version 6.0.8-tuxcare.1 of org.springframework.security:spring-security-data."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7f24a75b-c969-5be6-9dfb-2bd69335a41e",
      "id": "CVE-2026-41694",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41694 affects version 6.0.8-tuxcare.1 of org.springframework.security:spring-security-data."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:eee4f7d0-a10e-5a54-9db7-fc25502dbf48",
      "id": "CVE-2026-41706",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41706 affects version 6.0.8-tuxcare.1 of org.springframework.security:spring-security-data."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5e511c0e-31fa-541e-a665-1ffcc1885d73",
      "id": "CVE-2026-47838",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-47838 affects version 6.0.8-tuxcare.1 of org.springframework.security:spring-security-data."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-data@6.0.8-tuxcare.1"
    }
  ]
}