{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:84bf842d-61dc-5be9-b295-aece5703565d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-ai-neo4j-store",
      "purl": "pkg:maven/org.springframework.ai/spring-ai-neo4j-store@1.0.9-tuxcare.1",
      "type": "library",
      "group": "org.springframework.ai",
      "bom-ref": "pkg:maven/org.springframework.ai/spring-ai-neo4j-store@1.0.9-tuxcare.1",
      "version": "1.0.9-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-ai-neo4j-store",
            "purl": "pkg:maven/org.springframework.ai/spring-ai-neo4j-store@1.0.9",
            "type": "library",
            "group": "org.springframework.ai",
            "version": "1.0.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-22743",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.ai/spring-ai-neo4j-store@1.0.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a66552f3-1f7c-5b4a-ae44-5ed00e907435",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22743 does not affect version 1.0.9-tuxcare.1 of org.springframework.ai:spring-ai-neo4j-store. The target repository spring-ai version 1.0.9 is NOT AFFECTED by CVE-2026-22743. The vulnerable code pattern (backtick injection in Neo4jVectorFilterExpressionConverter) is not present because the upstream vendor (Broadcom) fixed it in commit c4297444f before TuxCare onboarded this version. The fix uses SchemaNames.sanitize() to properly escape backticks and control characters in filter expression keys, preventing Cypher injection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.0-M5, < 1.0.5; >= 1.1.0-M1, < 1.1.4), NVD (>= 1.0.0, < 1.0.5; >= 1.1.0, < 1.1.4), cve.org (>= 1.0.0, < 1.0.5; >= 1.1.0, < 1.1.4), Snyk (< 1.0.5; >= 1.1.0-M1, < 1.1.4).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.ai/spring-ai-neo4j-store@1.0.9-tuxcare.1"
    }
  ]
}