{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:6a72da50-fa82-547b-84a8-79fae34df7a7",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-ai-redis-store",
      "purl": "pkg:maven/org.springframework.ai/spring-ai-redis-store@1.0.9-tuxcare.1",
      "type": "library",
      "group": "org.springframework.ai",
      "bom-ref": "pkg:maven/org.springframework.ai/spring-ai-redis-store@1.0.9-tuxcare.1",
      "version": "1.0.9-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-ai-redis-store",
            "purl": "pkg:maven/org.springframework.ai/spring-ai-redis-store@1.0.9",
            "type": "library",
            "group": "org.springframework.ai",
            "version": "1.0.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-22744",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.ai/spring-ai-redis-store@1.0.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d0b8d85c-e01c-5aef-a833-1854674b6203",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22744 does not affect version 1.0.9-tuxcare.1 of org.springframework.ai:spring-ai-redis-store. The target repository version 1.0.9 does not contain CVE-2026-22744. The vulnerable code pattern (unescaped string concatenation in TAG/TEXT filter values allowing RediSearch query injection) was already fixed by upstream Spring AI developers (Broadcom) in commit 6c99d545e and shipped in version 1.0.9, which TuxCare then onboarded. The fix adds proper character escaping via escapeTagValue() for TAG fields and RediSearchUtil.escapeQuery() for TEXT fields, preventing injection of arbitrary query terms through special characters like }, |, {, etc.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.0-M5, < 1.0.5; >= 1.1.0-M1, < 1.1.4), NVD (>= 1.0.0, < 1.0.5; >= 1.1.0, < 1.1.4), cve.org (>= 1.0.0, < 1.0.5; >= 1.1.0, < 1.1.4), Snyk (< 1.0.5; >= 1.1.0-M1, < 1.1.4).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.ai/spring-ai-redis-store@1.0.9-tuxcare.1"
    }
  ]
}