{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:68b1a0da-d760-55bf-a856-819ccc955cb0",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.neo4j.driver/neo4j-java-driver-all@5.28.5-tuxcare.1",
      "type": "library",
      "group": "org.neo4j.driver",
      "name": "neo4j-java-driver-all",
      "version": "5.28.5-tuxcare.1",
      "purl": "pkg:maven/org.neo4j.driver/neo4j-java-driver-all@5.28.5-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:55d529f4-cb5e-5e23-b8df-330b0453cb3c",
      "id": "CVE-2026-1337",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2026-1337 is a false positive for org.neo4j.driver:neo4j-java-driver-all 5.28.5-tuxcare.1. false_positive \u2014 CVE-2026-1337 is a wrong-project match. The CVE targets Neo4j Enterprise and Community editions (database server products) and concerns insufficient escaping of unicode characters in the server's query log feature. The target repository is neo4j-java-driver v5.28.5, a client library for connecting to Neo4j databases via the Bolt protocol. The driver does not contain Neo4j server code (neither a..."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.neo4j.driver/neo4j-java-driver-all@5.28.5-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.neo4j.driver/neo4j-java-driver-all@5.28.5-tuxcare.1"
    }
  ]
}