{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4b5a9a8c-a19a-54fe-80ab-b2456ff0a10b",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.4.13-tuxcare.3",
      "type": "library",
      "group": "org.springframework.security",
      "name": "spring-security-rsocket",
      "version": "6.4.13-tuxcare.3",
      "purl": "pkg:maven/org.springframework.security/spring-security-rsocket@6.4.13-tuxcare.3"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:5503ede9-879d-5da1-bed3-e6613dc7883d",
      "id": "CVE-2026-22732",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22732 is fixed in version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.4.13-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:5362ccc6-2ef1-530c-b3ec-5d459f18ad81",
      "id": "CVE-2026-22746",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22746 is fixed in version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.4.13-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:98769d0f-34ca-534f-a614-abb36b3fb7b2",
      "id": "CVE-2026-22747",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22747 does not affect version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-rsocket. Spring Security 6.4.13 is outside the affected range (7.0.0\u20137.0.4). CVE-2026-22747 affects the DN parsing logic in SubjectX500PrincipalExtractor, which can incorrectly extract a username from a certificate subject. This class and its associated authentication path are absent in 6.4.13, where X.509 authentication uses SubjectDnX509PrincipalExtractor instead. Therefore, the vulnerable code path does not exist in this version."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.4.13-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3da27f41-add3-5561-8f57-d278e542f178",
      "id": "CVE-2026-22748",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22748 is fixed in version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.4.13-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:51130713-3408-593c-96bb-437084ebda66",
      "id": "CVE-2026-22751",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22751 is fixed in version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.4.13-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c82f8a91-8533-55d0-9587-62cb0366fa13",
      "id": "CVE-2026-22753",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22753 does not affect version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-rsocket. not_affected \u2014 Spring Security 6.4.13 is not affected by CVE-2026-22753. This vulnerability is specific to the PathPatternRequestMatcher.Builder bean feature introduced in Spring Security 7.0.0. Version 6.4.13 uses a different architecture (MvcRequestMatcher with automatic servlet path detection) that does not have this vulnerability."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.4.13-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b0899f35-bf6e-54ce-8dd1-f4cd7652696d",
      "id": "CVE-2026-22754",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22754 does not affect version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-rsocket. not_affected \u2014 Spring Security 6.4.13 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a bug in PathPatternRequestMatcherFactoryBean where the builder's basePath() method is called without capturing its return value. Version 6.4.13 does not contain PathPatternRequestMatcher or PathPatternRequestMatcherFactoryBean classes. Instead, it uses the older MvcRequestMa..."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.4.13-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:9ab54738-adc9-57ef-a83b-557547b48177",
      "id": "CVE-2026-40988",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-40988 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.4.13-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4b100fd8-78b0-5046-a898-92e15ee650ca",
      "id": "CVE-2026-40993",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40993 does not affect version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-rsocket. Spring Security 6.4.13 is not affected by CVE-2026-40993. The vulnerable component JdbcAssertingPartyMetadataRepository does not exist in this version. This JDBC-based repository for storing SAML2 asserting party metadata in a database was introduced in Spring Security 7.0.x. Version 6.4.13 only provides in-memory and OpenSAML-based metadata repositories that do not involve database deserialization of credentials."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.4.13-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:1be6b1c0-f9ef-5e83-a4a6-80175fd214f7",
      "id": "CVE-2026-41003",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41003 is fixed in version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.4.13-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:05c1faba-0247-5405-88b7-9efbd85f3abb",
      "id": "CVE-2026-41694",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41694 is fixed in version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.4.13-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:7a526d65-12f3-538f-b339-9f4d4adfcb2f",
      "id": "CVE-2026-41706",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41706 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.4.13-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:e5d11912-be08-5eae-a69d-b51b7aefa69f",
      "id": "CVE-2026-47838",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47838 is fixed in version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.4.13-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:63049782-8eee-5896-afc5-c16e93ca7380",
      "id": "CVE-2026-47841",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-47841 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.4.13-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:d940ef9f-d479-5ecc-9f34-b69e132be274",
      "id": "CVE-2026-47842",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-47842 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.4.13-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:96e916e9-2e51-5b17-8c56-db8127b4a02f",
      "id": "CVE-2026-59270",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59270 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.4.13-tuxcare.3"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:c44112ff-e682-52c0-9a2a-2d8e8fe656ee",
      "id": "CVE-2026-59276",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59276 affects version 6.4.13-tuxcare.3 of org.springframework.security:spring-security-rsocket."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.4.13-tuxcare.3"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.security/spring-security-rsocket@6.4.13-tuxcare.3"
    }
  ]
}