{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:57db8ba6-5820-5869-9b8e-cc3596ee9940",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-ai-azure-cosmos-db-store",
      "purl": "pkg:maven/org.springframework.ai/spring-ai-azure-cosmos-db-store@1.1.8-tuxcare.1",
      "type": "library",
      "group": "org.springframework.ai",
      "bom-ref": "pkg:maven/org.springframework.ai/spring-ai-azure-cosmos-db-store@1.1.8-tuxcare.1",
      "version": "1.1.8-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-ai-azure-cosmos-db-store",
            "purl": "pkg:maven/org.springframework.ai/spring-ai-azure-cosmos-db-store@1.1.8",
            "type": "library",
            "group": "org.springframework.ai",
            "version": "1.1.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-40978",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.ai/spring-ai-azure-cosmos-db-store@1.1.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f9c00756-74d2-5475-b4ca-586b2d1b2702",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40978 does not affect version 1.1.8-tuxcare.1 of org.springframework.ai:spring-ai-azure-cosmos-db-store. Target version 1.1.8 is NOT AFFECTED. The SQL injection vulnerability (CVE-2026-40978) in CosmosDBVectorStore's doDelete method has been fixed by the upstream vendor. The vulnerable code used String.format to construct SQL queries with user-supplied document IDs, enabling SQL injection. The fix (commit 6039e5752) replaced string formatting with parameterized queries using SqlQuerySpec and SqlParameter. This fix was already present in upstream Spring AI release 1.1.8 before TuxCare onboarded the version. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.0, < 1.0.6; >= 1.1.0, < 1.1.5), NVD (>= 1.0.0, < 1.0.6; >= 1.1.0, < 1.1.5), cve.org (>= 1.0.0, < 1.0.6; >= 1.1.0, < 1.1.5), Snyk (< 1.0.6; >= 1.1.0-M1, < 1.1.5).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.ai/spring-ai-azure-cosmos-db-store@1.1.8-tuxcare.1"
    }
  ]
}