{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:645a21cc-d028-5d6c-9ac7-f7e9e366532f",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-ai-mariadb-store",
      "purl": "pkg:maven/org.springframework.ai/spring-ai-mariadb-store@1.0.9-tuxcare.1",
      "type": "library",
      "group": "org.springframework.ai",
      "bom-ref": "pkg:maven/org.springframework.ai/spring-ai-mariadb-store@1.0.9-tuxcare.1",
      "version": "1.0.9-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-ai-mariadb-store",
            "purl": "pkg:maven/org.springframework.ai/spring-ai-mariadb-store@1.0.9",
            "type": "library",
            "group": "org.springframework.ai",
            "version": "1.0.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-22730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.ai/spring-ai-mariadb-store@1.0.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:56edd021-bacd-5f27-a3cf-08adf4d0283d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-22730 does not affect version 1.0.9-tuxcare.1 of org.springframework.ai:spring-ai-mariadb-store. The target Spring AI v1.0.9 is not affected by CVE-2026-22730. The SQL injection vulnerability in MariaDBFilterExpressionConverter was already fixed by the upstream vendor (Broadcom/Spring) in commit a2f6f4cb before TuxCare onboarded version 1.0.9. The current code implements comprehensive SQL escaping via the emitSqlString() method, which properly escapes single quotes, backslashes, control characters, and Unicode control characters, preventing the SQL injection attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.1.0-M1, < 1.1.3; < 1.0.4), NVD (>= 1.0.0, < 1.0.4; >= 1.1.0, < 1.1.3), cve.org (>= 1.0.x, < 1.0.4; >= 1.1.x, < 1.1.3), Snyk (>= 1.0.0-M5, < 1.0.4; >= 1.1.0-M1, < 1.1.3; >= 2.0.0-M1, < 2.0.0-M3).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.ai/spring-ai-mariadb-store@1.0.9-tuxcare.1"
    }
  ]
}