{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:cd5a1be5-56a7-59bd-b424-e3e2739037cc",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-ai-milvus-store",
      "purl": "pkg:maven/org.springframework.ai/spring-ai-milvus-store@1.0.9-tuxcare.1",
      "type": "library",
      "group": "org.springframework.ai",
      "bom-ref": "pkg:maven/org.springframework.ai/spring-ai-milvus-store@1.0.9-tuxcare.1",
      "version": "1.0.9-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-ai-milvus-store",
            "purl": "pkg:maven/org.springframework.ai/spring-ai-milvus-store@1.0.9",
            "type": "library",
            "group": "org.springframework.ai",
            "version": "1.0.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-41705",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.ai/spring-ai-milvus-store@1.0.9-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7f5b1074-7e0d-572c-9252-48a6d6a4c202",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41705 does not affect version 1.0.9-tuxcare.1 of org.springframework.ai:spring-ai-milvus-store. CVE-2026-41705 affects Spring AI's MilvusVectorStore#doDelete(List) implementation via filter-expression injection through unsanitized document IDs. The target repository (Spring AI 1.0.9) is NOT AFFECTED because the upstream vendor (Soby Chacko from Broadcom) applied the fix in commit 864ef8129 before version 1.0.9 was released. The fix replaces naive single-quote wrapping with Jackson-based JSON escaping via MilvusFilterExpressionConverter::toFilterExpressionLiteral, preventing special characters from breaking out of string literals in Milvus filter expressions. The vulnerable code pattern is absent from the shipped version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 1.0.0, < 1.0.7; >= 1.1.0, < 1.1.6; >= 1.0.0, < 1.0.7; >= 1.1.0, < 1.1.6), NVD (>= 1.0.0, < 1.0.7; >= 1.1.0, < 1.1.6), cve.org (>= 1.0.0, < 1.0.7; >= 1.1.0, < 1.1.6), Snyk (< 1.0.7; >= 1.1.0-M1, < 1.1.6; < 1.0.7; >= 1.1.0-M1, < 1.1.6).",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.ai/spring-ai-milvus-store@1.0.9-tuxcare.1"
    }
  ]
}