{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a3be54e9-c1f8-5d69-986e-c067315d75fc",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-ai-gemfire-store",
      "purl": "pkg:maven/org.springframework.ai/spring-ai-gemfire-store@1.1.8-tuxcare.1",
      "type": "library",
      "group": "org.springframework.ai",
      "bom-ref": "pkg:maven/org.springframework.ai/spring-ai-gemfire-store@1.1.8-tuxcare.1",
      "version": "1.1.8-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-ai-gemfire-store",
            "purl": "pkg:maven/org.springframework.ai/spring-ai-gemfire-store@1.1.8",
            "type": "library",
            "group": "org.springframework.ai",
            "version": "1.1.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-47835",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.ai/spring-ai-gemfire-store@1.1.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3469ee7e-74f7-52fd-8708-7170aeec9d52",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47835 does not affect version 1.1.8-tuxcare.1 of org.springframework.ai:spring-ai-gemfire-store. The target repository (Spring AI version 1.1.8) is not affected by CVE-2026-47835. The vulnerability, which allowed special characters to force execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire vector stores, has been fixed by upstream commit 2b20cfc8f. This fix was already present in the upstream 1.1.8 release before TuxCare onboarded it. The fix adds proper escaping for special whitespace characters (tab, newline, carriage return, ideographic space) in the AbstractFilterExpressionConverter.emitLuceneString() method, preventing them from being interpreted as Lucene query operators.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.0, < 1.0.9; >= 1.1.0, < 1.1.8; >= 1.0.0, < 1.0.9; >= 1.1.0, < 1.1.8; >= 1.0.0, < 1.0.9; >= 1.1.0, < 1.1.8), NVD (>= 1.0.0, < 1.0.9; >= 1.1.0, < 1.1.8), cve.org (>= 1.0.0, < 1.0.9; >= 1.1.0, < 1.1.8), Snyk (< 1.0.9; >= 1.1.0-M1, < 1.1.8).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.ai/spring-ai-gemfire-store@1.1.8-tuxcare.1"
    }
  ]
}