{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:00f663bd-3292-5ff6-b048-c821b548302f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-ai-pdf-document-reader",
      "purl": "pkg:maven/org.springframework.ai/spring-ai-pdf-document-reader@1.1.8-tuxcare.1",
      "type": "library",
      "group": "org.springframework.ai",
      "bom-ref": "pkg:maven/org.springframework.ai/spring-ai-pdf-document-reader@1.1.8-tuxcare.1",
      "version": "1.1.8-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-ai-pdf-document-reader",
            "purl": "pkg:maven/org.springframework.ai/spring-ai-pdf-document-reader@1.1.8",
            "type": "library",
            "group": "org.springframework.ai",
            "version": "1.1.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-40980",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.ai/spring-ai-pdf-document-reader@1.1.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6c76b2c7-8a88-5d7f-bb31-5e7a1dc75f77",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-40980 does not affect version 1.1.8-tuxcare.1 of org.springframework.ai:spring-ai-pdf-document-reader. not_affected \u2014 The target Spring AI version 1.1.8 is NOT AFFECTED by CVE-2026-40980. The vulnerability involving excessive memory allocation via malformed PDF files has been fixed by upstream commit b61ac6a12 (\"Prevent excessive char allocation via malformed pdf\"), which was already included in the upstream release 1.1.8 before TuxCare onboarded it. Both critical defenses are present: (1) lineLength validatio...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47851",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.ai/spring-ai-pdf-document-reader@1.1.8-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7ce261a6-0504-5638-b751-4ce56a46406c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47851 is fixed in version 1.1.8-tuxcare.1 of org.springframework.ai:spring-ai-pdf-document-reader."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.ai/spring-ai-pdf-document-reader@1.1.8-tuxcare.1"
    }
  ]
}