{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3c45e277-1014-5766-9873-c51f3c4b27d2",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-ai-pdf-document-reader",
      "purl": "pkg:maven/org.springframework.ai/spring-ai-pdf-document-reader@1.0.9-tuxcare.1",
      "type": "library",
      "group": "org.springframework.ai",
      "bom-ref": "pkg:maven/org.springframework.ai/spring-ai-pdf-document-reader@1.0.9-tuxcare.1",
      "version": "1.0.9-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-ai-pdf-document-reader",
            "purl": "pkg:maven/org.springframework.ai/spring-ai-pdf-document-reader@1.0.9",
            "type": "library",
            "group": "org.springframework.ai",
            "version": "1.0.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-40980",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.ai/spring-ai-pdf-document-reader@1.0.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:be891046-9b05-52f1-a808-5605938a48bb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40980 does not affect version 1.0.9-tuxcare.1 of org.springframework.ai:spring-ai-pdf-document-reader. not_affected \u2014 Target version 1.0.9 is NOT AFFECTED. The vulnerability pattern (unbounded memory allocation via malicious PDF dimensions) is not present because the upstream vendor's fix is already applied. Both validation checks from the security patch are present in the code: TextLine.java validates lineLength \u2264 14,400 (lines 40-46), and ForkPDFLayoutTextStripper.java validates numberOfNewLines \u2264 10,000 (li...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47851",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.ai/spring-ai-pdf-document-reader@1.0.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:612a7bbb-077e-5278-a3b9-f6e713519297",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47851 is fixed in version 1.0.9-tuxcare.1 of org.springframework.ai:spring-ai-pdf-document-reader."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.ai/spring-ai-pdf-document-reader@1.0.9-tuxcare.1"
    }
  ]
}