{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:2cfc408f-3710-5de0-8862-b5e3a0ccc8cc",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:maven/org.springframework.data/spring-data-redis@3.3.13-tuxcare.1",
      "type": "library",
      "group": "org.springframework.data",
      "name": "spring-data-redis",
      "version": "3.3.13-tuxcare.1",
      "purl": "pkg:maven/org.springframework.data/spring-data-redis@3.3.13-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:9c2c5bb2-a0fa-5fcc-bb5b-606c70efce5d",
      "id": "CVE-2026-41719",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41719 does not affect version 3.3.13-tuxcare.1 of org.springframework.data:spring-data-redis. not_affected \u2014 CVE-2026-41719 concerns a SpEL Injection vulnerability in Spring Data KeyValue's SpelPropertyComparator. Spring Data Redis (this repository) depends on Spring Data KeyValue but does not contain the vulnerable code. The vulnerability exists only in the declared dependency (spring-data-keyvalue JAR), not in spring-data-redis source code. While spring-data-redis uses SpelSortAccessor from the depe..."
      },
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.data/spring-data-redis@3.3.13-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.data/spring-data-redis@3.3.13-tuxcare.1"
    }
  ]
}