{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:bd048928-92cf-514c-8e08-138fdc2c26ae",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-ai-azure-cosmos-db-store",
      "purl": "pkg:maven/org.springframework.ai/spring-ai-azure-cosmos-db-store@1.0.9-tuxcare.1",
      "type": "library",
      "group": "org.springframework.ai",
      "bom-ref": "pkg:maven/org.springframework.ai/spring-ai-azure-cosmos-db-store@1.0.9-tuxcare.1",
      "version": "1.0.9-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-ai-azure-cosmos-db-store",
            "purl": "pkg:maven/org.springframework.ai/spring-ai-azure-cosmos-db-store@1.0.9",
            "type": "library",
            "group": "org.springframework.ai",
            "version": "1.0.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-40978",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.ai/spring-ai-azure-cosmos-db-store@1.0.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:fbfcfa66-35bf-5228-8d12-6f9f9175e961",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40978 does not affect version 1.0.9-tuxcare.1 of org.springframework.ai:spring-ai-azure-cosmos-db-store. The SQL injection vulnerability in CosmosDBVectorStore.doDelete() is not present in the target. The upstream vendor (Spring/VMware) fixed this vulnerability in Spring AI 1.0.9 by replacing string formatting with parameterized queries. The fix commit b32096e6b was authored by soby.chacko@broadcom.com and shipped in the upstream 1.0.9 release that TuxCare subsequently onboarded. The vulnerable pattern (String.format for SQL query construction) has been replaced with SqlQuerySpec and SqlParameter, preventing document ID injection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.0, < 1.0.6; >= 1.1.0, < 1.1.5), NVD (>= 1.0.0, < 1.0.6; >= 1.1.0, < 1.1.5), cve.org (>= 1.0.0, < 1.0.6; >= 1.1.0, < 1.1.5), Snyk (< 1.0.6; >= 1.1.0-M1, < 1.1.5).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.ai/spring-ai-azure-cosmos-db-store@1.0.9-tuxcare.1"
    }
  ]
}