{
  "@id": "urn:uuid:5d80dd18-34c3-4de6-a996-096a1e1dad32",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.graphql-java/graphql-java@21.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.graphql-java/graphql-java@21.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2022-37734 does not affect version 21.5-tuxcare.1 of com.graphql-java:graphql-java. CVE-2022-37734 is NOT present in graphql-java version 21.5. The DoS vulnerability (CPU resource exhaustion via unbounded token generation during GraphQL query parsing) was fixed in upstream commit 226aabd9 by Brad Baker (Atlassian), which shipped in version 19.0 and all subsequent releases including 21.5. The fix introduces SafeTokenSource that wraps the lexer and limits grammar tokens to 15,000 and whitespace tokens to 200,000, throwing ParseCancelledException when exceeded. This protection is active by default for operation parsing via getDefaultOperationParserOptions(). TuxCare onboarded version 21.5 with this fix already present in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 17.4; >= 18.0, < 18.3), NVD (< 17.4; >= 18.0, < 18.3), Snyk (< 0.0.0-2022-07-26T05-45-04-226aabd9; >= 17.0, < 17.4; >= 18.0, < 18.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-37734"
      },
      "impact_statement": "CVE-2022-37734 is NOT present in graphql-java version 21.5. The DoS vulnerability (CPU resource exhaustion via unbounded token generation during GraphQL query parsing) was fixed in upstream commit 226aabd9 by Brad Baker (Atlassian), which shipped in version 19.0 and all subsequent releases including 21.5. The fix introduces SafeTokenSource that wraps the lexer and limits grammar tokens to 15,000 and whitespace tokens to 200,000, throwing ParseCancelledException when exceeded. This protection is active by default for operation parsing via getDefaultOperationParserOptions(). TuxCare onboarded version 21.5 with this fix already present in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 17.4; >= 18.0, < 18.3), NVD (< 17.4; >= 18.0, < 18.3), Snyk (< 0.0.0-2022-07-26T05-45-04-226aabd9; >= 17.0, < 17.4; >= 18.0, < 18.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.graphql-java/graphql-java@21.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.graphql-java/graphql-java@21.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability CVE-2023-28867 does not affect version 21.5-tuxcare.1 of com.graphql-java:graphql-java. The target repository (graphql-java version 21.5) is NOT AFFECTED by CVE-2023-28867. The vulnerability fix for stack overflow via deeply nested GraphQL queries was already present in the upstream release 21.5 that TuxCare onboarded. The fix includes parser rule depth tracking (MAX_RULE_DEPTH=500) that prevents stack consumption by rejecting queries exceeding the depth limit. This is an upstream fix authored by Brad Baker (bbaker@atlassian.com) committed on 2023-03-13, over 3 years before TuxCare's onboarding on 2026-09-26.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 0.0.0-2023-03-20T01-49-44-80e3135; >= 1.2, < 17.5; >= 18.0, < 18.4; >= 19.0, < 19.4; >= 20.0, < 20.1), NVD (< 17.5; >= 18.0, < 18.4; >= 19.0, < 19.4; = 20.0), Snyk (< 0.0.0-2023-03-20T01-49-44-80e3135; >= 1.2, < 17.5; >= 18.0, < 18.4; >= 19.0, < 19.4; >= 20.0, < 20.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-28867"
      },
      "impact_statement": "The target repository (graphql-java version 21.5) is NOT AFFECTED by CVE-2023-28867. The vulnerability fix for stack overflow via deeply nested GraphQL queries was already present in the upstream release 21.5 that TuxCare onboarded. The fix includes parser rule depth tracking (MAX_RULE_DEPTH=500) that prevents stack consumption by rejecting queries exceeding the depth limit. This is an upstream fix authored by Brad Baker (bbaker@atlassian.com) committed on 2023-03-13, over 3 years before TuxCare's onboarding on 2026-09-26.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 0.0.0-2023-03-20T01-49-44-80e3135; >= 1.2, < 17.5; >= 18.0, < 18.4; >= 19.0, < 19.4; >= 20.0, < 20.1), NVD (< 17.5; >= 18.0, < 18.4; >= 19.0, < 19.4; = 20.0), Snyk (< 0.0.0-2023-03-20T01-49-44-80e3135; >= 1.2, < 17.5; >= 18.0, < 18.4; >= 19.0, < 19.4; >= 20.0, < 20.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.graphql-java/graphql-java@21.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.graphql-java/graphql-java@21.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T22:20:00.067743+00:00",
      "status_notes": "Vulnerability CVE-2024-40094 does not affect version 21.5-tuxcare.1 of com.graphql-java:graphql-java. not_affected \u2014 The target repository at version 21.5-tuxcare.1 (SHA 70c40cf7) is not affected by CVE-2024-40094. The vulnerability pattern (unbounded ExecutableNormalizedField creation allowing DoS) is not present because the upstream graphql-java project included the fix in version 21.5 prior to TuxCare's onboarding. The defense code (maxFieldsCount limit with AbortExecutionException, GOOD_FAITH_MAX_FIELDS_C...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-40094"
      },
      "impact_statement": "not_affected \u2014 The target repository at version 21.5-tuxcare.1 (SHA 70c40cf7) is not affected by CVE-2024-40094. The vulnerability pattern (unbounded ExecutableNormalizedField creation allowing DoS) is not present because the upstream graphql-java project included the fix in version 21.5 prior to TuxCare's onboarding. The defense code (maxFieldsCount limit with AbortExecutionException, GOOD_FAITH_MAX_FIELDS_C..."
    }
  ]
}