{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2d4aa491-c9c9-516b-821e-7a526cee6b61", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-graphql", "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.6", "type": "library", "group": "org.springframework.graphql", "bom-ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.6", "version": "1.1.7-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-graphql", "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7", "type": "library", "group": "org.springframework.graphql", "version": "1.1.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-34047", "affects": [ { "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.6" } ], "bom-ref": "urn:uuid:88d40aff-bf86-507b-9946-f6ab8c3689c6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34047 does not affect version 1.1.7-tuxcare.6 of org.springframework.graphql:spring-graphql. not_affected \u2014 CVE-2023-34047 affects Spring for GraphQL versions 1.1.0-1.1.5 and 1.2.0-1.2.2, where batch loader DataLoaderOptions instances could be shared across sessions, causing security context leakage. The target version 1.1.7-tuxcare.4 is NOT vulnerable. The fix was delivered in upstream release 1.1.7 via commit e6453ef9 (Dec 2021) by Rossen Stoyanchev (Spring/VMware team), which ensures per-request D...", "justification": "code_not_present" } }, { "id": "CVE-2026-41699", "affects": [ { "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.6" } ], "bom-ref": "urn:uuid:5fcd42a9-06c3-5d3e-980f-b73b1bcf5ad3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41699 does not affect version 1.1.7-tuxcare.6 of org.springframework.graphql:spring-graphql. Spring GraphQL v1.1.7 is not affected by CVE-2026-41699. The vulnerable component (JsonKeysetCursorStrategy with unsafe polymorphic deserialization) does not exist in this version. The pagination feature with cursor-based scrolling was introduced in v1.2.0 (March 2023), while v1.1.7 is from the earlier 1.1.x maintenance branch that predates this functionality.", "justification": "code_not_present" } }, { "id": "CVE-2026-41700", "affects": [ { "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.6" } ], "bom-ref": "urn:uuid:63113602-7bf0-57fc-9ae3-802b61ae8419", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41700 is fixed in version 1.1.7-tuxcare.6 of org.springframework.graphql:spring-graphql." } }, { "id": "CVE-2026-41856", "affects": [ { "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.6" } ], "bom-ref": "urn:uuid:bff9b564-e6d1-51c7-b067-2967cfa8ae1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41856 is fixed in version 1.1.7-tuxcare.6 of org.springframework.graphql:spring-graphql." } }, { "id": "CVE-2026-59285", "affects": [ { "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.6" } ], "bom-ref": "urn:uuid:123cc3c0-f910-50ea-b7f6-23a1ccaaeb40", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59285 does not affect version 1.1.7-tuxcare.6 of org.springframework.graphql:spring-graphql. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 1.1.7 is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only).", "justification": "code_not_present" } }, { "id": "CVE-2026-59286", "affects": [ { "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.6" } ], "bom-ref": "urn:uuid:293656b6-1c5c-5dc4-9cfb-d10aa4d80a33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59286 is fixed in version 1.1.7-tuxcare.6 of org.springframework.graphql:spring-graphql." } }, { "id": "CVE-2026-59287", "affects": [ { "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.6" } ], "bom-ref": "urn:uuid:2ed7adeb-202b-5775-9c66-86102b447a49", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59287 does not affect version 1.1.7-tuxcare.6 of org.springframework.graphql:spring-graphql. not_affected \u2014 Version 1.1.7 is NOT AFFECTED by CVE-2026-59287. The vulnerability requires the WebSocket client keepAlive feature to be enabled, but this feature does not exist in version 1.1.7. The keepAlive feature was introduced in commit 3f5fc1a5 (Feb 8, 2023) and first released in v1.3.0-RC1. Version 1.1.7 is on the 1.1.x maintenance branch and predates this feature. Exhaustive search confirms zero keepA...", "justification": "code_not_present" } }, { "id": "CVE-2026-59288", "affects": [ { "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.6" } ], "bom-ref": "urn:uuid:b6027746-521f-51ca-a940-efa8881d14ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59288 is fixed in version 1.1.7-tuxcare.6 of org.springframework.graphql:spring-graphql." } }, { "id": "CVE-2026-59289", "affects": [ { "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.6" } ], "bom-ref": "urn:uuid:a37121a3-372a-51db-9344-a8eef970e271", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59289 does not affect version 1.1.7-tuxcare.6 of org.springframework.graphql:spring-graphql. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 1.1.7 is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only).", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.6" } ] }