{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:77124a5f-6da5-5885-92ec-a70dd9d8bae3",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-ai-neo4j-store",
      "purl": "pkg:maven/org.springframework.ai/spring-ai-neo4j-store@1.1.8-tuxcare.1",
      "type": "library",
      "group": "org.springframework.ai",
      "bom-ref": "pkg:maven/org.springframework.ai/spring-ai-neo4j-store@1.1.8-tuxcare.1",
      "version": "1.1.8-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-ai-neo4j-store",
            "purl": "pkg:maven/org.springframework.ai/spring-ai-neo4j-store@1.1.8",
            "type": "library",
            "group": "org.springframework.ai",
            "version": "1.1.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-22743",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.ai/spring-ai-neo4j-store@1.1.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bc1b1562-ade7-5b05-a0e8-882e8455b68f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22743 does not affect version 1.1.8-tuxcare.1 of org.springframework.ai:spring-ai-neo4j-store. The target repository (spring-ai 1.1.8) does not contain the Cypher injection vulnerability described in CVE-2026-22743. The vulnerable code pattern (manual backtick wrapping with only double-quote stripping) was fixed by upstream commit 3a46c7dd0, which replaced the unsafe string concatenation with SchemaNames.sanitize() that properly escapes embedded backticks by doubling them. This fix was already present in spring-ai version 1.1.8 when TuxCare onboarded it, making this an upstream-vendor fix rather than a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.0-M5, < 1.0.5; >= 1.1.0-M1, < 1.1.4), NVD (>= 1.0.0, < 1.0.5; >= 1.1.0, < 1.1.4), cve.org (>= 1.0.0, < 1.0.5; >= 1.1.0, < 1.1.4), Snyk (< 1.0.5; >= 1.1.0-M1, < 1.1.4).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.ai/spring-ai-neo4j-store@1.1.8-tuxcare.1"
    }
  ]
}