{
  "@id": "urn:uuid:1af18dfb-09ea-4757-b41b-d8b9a073dda3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T03:19:00.036407+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T03:19:00.036407+00:00",
      "status_notes": "Vulnerability CVE-2023-34047 does not affect version 1.3.7-tuxcare.3 of org.springframework.graphql:spring-graphql. not_affected \u2014 CVE-2023-34047 is NOT present in spring-graphql 1.3.7-tuxcare.7. The vulnerability affected versions 1.1.0-1.1.5 and 1.2.0-1.2.2, where user-provided DataLoaderOptions instances could be shared across sessions, causing security context leakage. The fix (commit 2539d95f) was applied by upstream Spring in version 1.2.3, well before version 1.3.7 was released. The fix ensures that DataLoaderOption...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34047"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-34047 is NOT present in spring-graphql 1.3.7-tuxcare.7. The vulnerability affected versions 1.1.0-1.1.5 and 1.2.0-1.2.2, where user-provided DataLoaderOptions instances could be shared across sessions, causing security context leakage. The fix (commit 2539d95f) was applied by upstream Spring in version 1.2.3, well before version 1.3.7 was released. The fix ensures that DataLoaderOption..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41699 affects version 1.3.7-tuxcare.3 of org.springframework.graphql:spring-graphql, and is fixed in 1.3.7-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41699"
      },
      "action_statement": "Vulnerability CVE-2026-41699 affects version 1.3.7-tuxcare.3 of org.springframework.graphql:spring-graphql, and is fixed in 1.3.7-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41700 affects version 1.3.7-tuxcare.3 of org.springframework.graphql:spring-graphql, and is fixed in 1.3.7-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41700"
      },
      "action_statement": "Vulnerability CVE-2026-41700 affects version 1.3.7-tuxcare.3 of org.springframework.graphql:spring-graphql, and is fixed in 1.3.7-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41856 affects version 1.3.7-tuxcare.3 of org.springframework.graphql:spring-graphql, and is fixed in 1.3.7-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41856"
      },
      "action_statement": "Vulnerability CVE-2026-41856 affects version 1.3.7-tuxcare.3 of org.springframework.graphql:spring-graphql, and is fixed in 1.3.7-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:40:55.741562+00:00",
      "status_notes": "Vulnerability CVE-2026-59285 affects version 1.3.7-tuxcare.3 of org.springframework.graphql:spring-graphql.",
      "vulnerability": {
        "name": "CVE-2026-59285"
      },
      "action_statement": "Vulnerability CVE-2026-59285 affects version 1.3.7-tuxcare.3 of org.springframework.graphql:spring-graphql."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59286 affects version 1.3.7-tuxcare.3 of org.springframework.graphql:spring-graphql, and is fixed in 1.3.7-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-59286"
      },
      "action_statement": "Vulnerability CVE-2026-59286 affects version 1.3.7-tuxcare.3 of org.springframework.graphql:spring-graphql, and is fixed in 1.3.7-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-12T17:18:00.099879+00:00",
      "status_notes": "Vulnerability CVE-2026-59287 affects version 1.3.7-tuxcare.3 of org.springframework.graphql:spring-graphql, and is fixed in 1.3.7-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-59287"
      },
      "action_statement": "Vulnerability CVE-2026-59287 affects version 1.3.7-tuxcare.3 of org.springframework.graphql:spring-graphql, and is fixed in 1.3.7-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59288 affects version 1.3.7-tuxcare.3 of org.springframework.graphql:spring-graphql, and is fixed in 1.3.7-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-59288"
      },
      "action_statement": "Vulnerability CVE-2026-59288 affects version 1.3.7-tuxcare.3 of org.springframework.graphql:spring-graphql, and is fixed in 1.3.7-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59289 affects version 1.3.7-tuxcare.3 of org.springframework.graphql:spring-graphql, and is fixed in 1.3.7-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-59289"
      },
      "action_statement": "Vulnerability CVE-2026-59289 affects version 1.3.7-tuxcare.3 of org.springframework.graphql:spring-graphql, and is fixed in 1.3.7-tuxcare.4."
    }
  ]
}