{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:306cb0a4-aaab-5c4a-8270-610f5aec7570",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-graphql",
      "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.4-tuxcare.2",
      "type": "library",
      "group": "org.springframework.graphql",
      "bom-ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.4-tuxcare.2",
      "version": "1.2.4-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-graphql",
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.4",
            "type": "library",
            "group": "org.springframework.graphql",
            "version": "1.2.4"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-34047",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.4-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9b2c6b24-95d6-5301-b06e-6512c3f30f78",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34047 does not affect version 1.2.4-tuxcare.2 of org.springframework.graphql:spring-graphql. not_affected \u2014 Spring for GraphQL version 1.2.4 is NOT affected by CVE-2023-34047. The CVE affects versions 1.1.0-1.1.5 and 1.2.0-1.2.2; version 1.2.4 is after the affected range. The vulnerability involved session context leakage when DataLoaderOptions instances were shared across GraphQL requests. The upstream fix (commit 2539d95f by Rossen Stoyanchev) ensures each request gets an isolated DataLoaderOptions...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41699",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.4-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f16efa8b-7067-5f4f-ae28-e2e4788aaa02",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41699 is fixed in version 1.2.4-tuxcare.2 of org.springframework.graphql:spring-graphql."
      }
    },
    {
      "id": "CVE-2026-41700",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.4-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:43d4763b-05d3-5dc3-ba56-9083f8cb46a6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41700 is fixed in version 1.2.4-tuxcare.2 of org.springframework.graphql:spring-graphql."
      }
    },
    {
      "id": "CVE-2026-41856",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.4-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:26149696-7850-5508-a4fc-1726e3bed535",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41856 is fixed in version 1.2.4-tuxcare.2 of org.springframework.graphql:spring-graphql."
      }
    },
    {
      "id": "CVE-2026-59285",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.4-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0c84d97e-1af1-5355-8da9-b2506039c79f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59285 affects version 1.2.4-tuxcare.2 of org.springframework.graphql:spring-graphql."
      }
    },
    {
      "id": "CVE-2026-59286",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.4-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6bfe6905-69ea-5f47-af43-04e0bf6f30a8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59286 is fixed in version 1.2.4-tuxcare.2 of org.springframework.graphql:spring-graphql."
      }
    },
    {
      "id": "CVE-2026-59287",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.4-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6b94a05e-15ad-5205-9644-b1e3faa1fe06",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-59287 does not affect version 1.2.4-tuxcare.2 of org.springframework.graphql:spring-graphql. not_affected \u2014 Spring GraphQL version 1.2.4 is not affected by CVE-2026-59287. The vulnerability requires the keepAlive feature in WebSocketGraphQlClient, which was introduced in version 1.3.5 (commit 3f5fc1a5, February 2023) and does not exist in version 1.2.4. Without the keepAlive feature, the duplicate keepAlive handler vulnerability pattern cannot manifest. Exhaustive searches confirmed no keepAlive conf...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-59288",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.4-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9b25ba56-f651-5243-85c1-9bdad5c0d449",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59288 is fixed in version 1.2.4-tuxcare.2 of org.springframework.graphql:spring-graphql."
      }
    },
    {
      "id": "CVE-2026-59289",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.4-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ad3a4633-ded5-557b-ba75-7a98fc848379",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59289 is fixed in version 1.2.4-tuxcare.2 of org.springframework.graphql:spring-graphql."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.4-tuxcare.2"
    }
  ]
}