{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b94580c2-b1bd-51fa-9435-31c35cd17218",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-ai-redis-store",
      "purl": "pkg:maven/org.springframework.ai/spring-ai-redis-store@1.1.8-tuxcare.1",
      "type": "library",
      "group": "org.springframework.ai",
      "bom-ref": "pkg:maven/org.springframework.ai/spring-ai-redis-store@1.1.8-tuxcare.1",
      "version": "1.1.8-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-ai-redis-store",
            "purl": "pkg:maven/org.springframework.ai/spring-ai-redis-store@1.1.8",
            "type": "library",
            "group": "org.springframework.ai",
            "version": "1.1.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-22744",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.ai/spring-ai-redis-store@1.1.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9e399e5b-7b13-57f0-a79b-34fe9cf8bf9c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22744 does not affect version 1.1.8-tuxcare.1 of org.springframework.ai:spring-ai-redis-store. The target repository (Spring AI 1.1.8) is NOT AFFECTED by CVE-2026-22744. The vulnerability concerns missing input escaping in RedisFilterExpressionConverter that allows RediSearch query injection. The fix (commit 707e990c9) is already present in the codebase, having shipped in the upstream Spring AI 1.1.8 release that TuxCare onboarded. The vulnerable stringValue() method no longer exists; it has been replaced with tagStringValue() and textStringValue() methods that properly escape special characters before query concatenation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.0-M5, < 1.0.5; >= 1.1.0-M1, < 1.1.4), NVD (>= 1.0.0, < 1.0.5; >= 1.1.0, < 1.1.4), cve.org (>= 1.0.0, < 1.0.5; >= 1.1.0, < 1.1.4), Snyk (< 1.0.5; >= 1.1.0-M1, < 1.1.4).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.ai/spring-ai-redis-store@1.1.8-tuxcare.1"
    }
  ]
}