{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:705cbd15-7fe8-5521-ba99-216c17a394ed",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "graphql-java",
      "purl": "pkg:maven/com.graphql-java/graphql-java@22.4-tuxcare.1",
      "type": "library",
      "group": "com.graphql-java",
      "bom-ref": "pkg:maven/com.graphql-java/graphql-java@22.4-tuxcare.1",
      "version": "22.4-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "graphql-java",
            "purl": "pkg:maven/com.graphql-java/graphql-java@22.4",
            "type": "library",
            "group": "com.graphql-java",
            "version": "22.4"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-37734",
      "affects": [
        {
          "ref": "pkg:maven/com.graphql-java/graphql-java@22.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c94b2a78-6915-5c0e-bb4f-34dff65a809c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2022-37734 does not affect version 22.4-tuxcare.1 of com.graphql-java:graphql-java. CVE-2022-37734 is not present in graphql-java 22.4. The vulnerability involves unbounded CPU consumption during GraphQL query lexing when attackers submit malicious queries with excessive tokens (directives, whitespace, comments). The upstream fix was authored by Brad Baker (bbaker@atlassian.com) in commit 226aabd9 and was already included in the upstream graphql-java 22.4 release that TuxCare onboarded. The fix introduces SafeTokenSource to limit grammar tokens (15,000) and whitespace tokens (200,000), throwing ParseCancelledException when exceeded. This protection is active by default in all query parsing operations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 17.4; >= 18.0, < 18.3), NVD (< 17.4; >= 18.0, < 18.3), Snyk (< 0.0.0-2022-07-26T05-45-04-226aabd9; >= 17.0, < 17.4; >= 18.0, < 18.3).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2023-28867",
      "affects": [
        {
          "ref": "pkg:maven/com.graphql-java/graphql-java@22.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:75f65c26-e0e4-534c-a464-79d79b69a201",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-28867 does not affect version 22.4-tuxcare.1 of com.graphql-java:graphql-java. Target graphql-java 22.4 is NOT AFFECTED by CVE-2023-28867 (stack consumption via deeply nested GraphQL queries). The upstream vendor fix (commits 8a1c884c/dcd9cf98 by Brad Baker) that limits parser grammar rule depth to 500 was already present in the upstream 22.4 release that TuxCare onboarded. The defense tracks parser rule depth via enterEveryRule/exitEveryRule callbacks and throws ParseCancelledTooDeepException when depth exceeds the configured limit, preventing stack overflow.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 0.0.0-2023-03-20T01-49-44-80e3135; >= 1.2, < 17.5; >= 18.0, < 18.4; >= 19.0, < 19.4; >= 20.0, < 20.1), NVD (< 17.5; >= 18.0, < 18.4; >= 19.0, < 19.4; = 20.0), Snyk (< 0.0.0-2023-03-20T01-49-44-80e3135; >= 1.2, < 17.5; >= 18.0, < 18.4; >= 19.0, < 19.4; >= 20.0, < 20.1).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-40094",
      "affects": [
        {
          "ref": "pkg:maven/com.graphql-java/graphql-java@22.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5d9a4981-b3a4-52e3-99a0-c638476888f7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-40094 does not affect version 22.4-tuxcare.1 of com.graphql-java:graphql-java. not_affected \u2014 CVE-2024-40094 describes a DoS vulnerability via excessive ExecutableNormalizedField (ENF) creation during introspection queries. The vendor patches (commits 97743bc1, fc6f304e, and related) added maxFieldsCount and maxChildrenDepth limits specifically for introspection queries to prevent resource exhaustion. Analysis of target version 22.4-tuxcare.1 confirms the complete fix is present: GoodFa...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/com.graphql-java/graphql-java@22.4-tuxcare.1"
    }
  ]
}