{
  "@id": "urn:uuid:78e11bfc-0fd4-4ef6-ae60-14f3d6500534",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.graphql-java/graphql-java@22.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.graphql-java/graphql-java@22.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2022-37734 does not affect version 22.3-tuxcare.1 of com.graphql-java:graphql-java. CVE-2022-37734 (DoS via excessive tokens) is NOT present in graphql-java 22.3-tuxcare.1. The fix (SafeTokenSource with maxWhitespaceTokens=200,000 and maxTokens=15,000 limits) was already included in upstream version 22.3, which TuxCare onboarded. The vulnerable pattern (unbounded token processing during lexing) does not exist. Fixing commit 226aabd9 by upstream author bbaker@atlassian.com predates the first TuxCare commit 0c3dfe37 in this branch's history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 17.4; >= 18.0, < 18.3), NVD (< 17.4; >= 18.0, < 18.3), Snyk (< 0.0.0-2022-07-26T05-45-04-226aabd9; >= 17.0, < 17.4; >= 18.0, < 18.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-37734"
      },
      "impact_statement": "CVE-2022-37734 (DoS via excessive tokens) is NOT present in graphql-java 22.3-tuxcare.1. The fix (SafeTokenSource with maxWhitespaceTokens=200,000 and maxTokens=15,000 limits) was already included in upstream version 22.3, which TuxCare onboarded. The vulnerable pattern (unbounded token processing during lexing) does not exist. Fixing commit 226aabd9 by upstream author bbaker@atlassian.com predates the first TuxCare commit 0c3dfe37 in this branch's history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 17.4; >= 18.0, < 18.3), NVD (< 17.4; >= 18.0, < 18.3), Snyk (< 0.0.0-2022-07-26T05-45-04-226aabd9; >= 17.0, < 17.4; >= 18.0, < 18.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.graphql-java/graphql-java@22.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.graphql-java/graphql-java@22.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:01:00.133094+00:00",
      "status_notes": "Vulnerability CVE-2023-28867 does not affect version 22.3-tuxcare.1 of com.graphql-java:graphql-java. The target repository (graphql-java version 22.3) is not affected by CVE-2023-28867. The vulnerability fix, which prevents stack overflow attacks via deeply nested GraphQL queries by limiting parser rule depth to 500, was already present in the upstream release that TuxCare onboarded. The fix was authored by Brad Baker (bbaker@atlassian.com) in commit 8a1c884c and shipped in the upstream version before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 0.0.0-2023-03-20T01-49-44-80e3135; >= 1.2, < 17.5; >= 18.0, < 18.4; >= 19.0, < 19.4; >= 20.0, < 20.1), NVD (< 17.5; >= 18.0, < 18.4; >= 19.0, < 19.4; = 20.0), Snyk (< 0.0.0-2023-03-20T01-49-44-80e3135; >= 1.2, < 17.5; >= 18.0, < 18.4; >= 19.0, < 19.4; >= 20.0, < 20.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-28867"
      },
      "impact_statement": "The target repository (graphql-java version 22.3) is not affected by CVE-2023-28867. The vulnerability fix, which prevents stack overflow attacks via deeply nested GraphQL queries by limiting parser rule depth to 500, was already present in the upstream release that TuxCare onboarded. The fix was authored by Brad Baker (bbaker@atlassian.com) in commit 8a1c884c and shipped in the upstream version before TuxCare's onboarding commit.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 0.0.0-2023-03-20T01-49-44-80e3135; >= 1.2, < 17.5; >= 18.0, < 18.4; >= 19.0, < 19.4; >= 20.0, < 20.1), NVD (< 17.5; >= 18.0, < 18.4; >= 19.0, < 19.4; = 20.0), Snyk (< 0.0.0-2023-03-20T01-49-44-80e3135; >= 1.2, < 17.5; >= 18.0, < 18.4; >= 19.0, < 19.4; >= 20.0, < 20.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.graphql-java/graphql-java@22.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.graphql-java/graphql-java@22.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T22:21:00.113708+00:00",
      "status_notes": "Vulnerability CVE-2024-40094 does not affect version 22.3-tuxcare.1 of com.graphql-java:graphql-java. not_affected \u2014 Target repository graphql-java version 22.3-tuxcare.1 is NOT AFFECTED by CVE-2024-40094. The vulnerability (unbounded ExecutableNormalizedField creation in introspection queries leading to DoS) was fixed in upstream commit 97743bc1 (2024-03-22) authored by Brad Baker. This fix was already present in the upstream release when TuxCare onboarded version 22.3 (commit 0c3dfe37, 2026-09-29). The targ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-40094"
      },
      "impact_statement": "not_affected \u2014 Target repository graphql-java version 22.3-tuxcare.1 is NOT AFFECTED by CVE-2024-40094. The vulnerability (unbounded ExecutableNormalizedField creation in introspection queries leading to DoS) was fixed in upstream commit 97743bc1 (2024-03-22) authored by Brad Baker. This fix was already present in the upstream release when TuxCare onboarded version 22.3 (commit 0c3dfe37, 2026-09-29). The targ..."
    }
  ]
}