{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:fc1b9aaf-6406-588f-9ad7-f5bad742f0f6",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-ai-gemfire-store",
      "purl": "pkg:maven/org.springframework.ai/spring-ai-gemfire-store@1.0.9-tuxcare.1",
      "type": "library",
      "group": "org.springframework.ai",
      "bom-ref": "pkg:maven/org.springframework.ai/spring-ai-gemfire-store@1.0.9-tuxcare.1",
      "version": "1.0.9-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-ai-gemfire-store",
            "purl": "pkg:maven/org.springframework.ai/spring-ai-gemfire-store@1.0.9",
            "type": "library",
            "group": "org.springframework.ai",
            "version": "1.0.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-47835",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.ai/spring-ai-gemfire-store@1.0.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:981be733-1804-54cd-ad32-3af605e802ec",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47835 does not affect version 1.0.9-tuxcare.1 of org.springframework.ai:spring-ai-gemfire-store. The target Spring AI 1.0.9 repository is NOT affected by CVE-2026-47835. The vulnerability involved missing escape sequences for whitespace control characters (tab, newline, carriage return, ideographic space) in vector store filter expressions, enabling Lucene query injection attacks. The fix (commit 9787991aa) was authored by the upstream vendor (Broadcom/Spring) and shipped in the Spring AI 1.0.9 release. TuxCare later onboarded this already-fixed version via commit ecb2df6a5. The vulnerable pattern is not present in the target at the authoritative SHA a26aa8d124e3a7fb74c145496aba67fcd465366a.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.0, < 1.0.9; >= 1.1.0, < 1.1.8; >= 1.0.0, < 1.0.9; >= 1.1.0, < 1.1.8; >= 1.0.0, < 1.0.9; >= 1.1.0, < 1.1.8), NVD (>= 1.0.0, < 1.0.9; >= 1.1.0, < 1.1.8), cve.org (>= 1.0.0, < 1.0.9; >= 1.1.0, < 1.1.8), Snyk (< 1.0.9; >= 1.1.0-M1, < 1.1.8).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.ai/spring-ai-gemfire-store@1.0.9-tuxcare.1"
    }
  ]
}