{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:5adcec91-34fa-57f8-94e9-6e72fee5f401",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-graphql",
      "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.4.6-tuxcare.2",
      "type": "library",
      "group": "org.springframework.graphql",
      "bom-ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.4.6-tuxcare.2",
      "version": "1.4.6-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-graphql",
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.4.6",
            "type": "library",
            "group": "org.springframework.graphql",
            "version": "1.4.6"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-34047",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.4.6-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c8ece929-e747-5269-afd0-669541bf978c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-34047 does not affect version 1.4.6-tuxcare.2 of org.springframework.graphql:spring-graphql. not_affected \u2014 CVE-2023-34047 affects Spring for GraphQL versions 1.1.0-1.1.5 and 1.2.0-1.2.2, where batch loader functions could be exposed to GraphQL context values from different sessions when DataLoaderOptions is provided during registration. The target version 1.4.6-tuxcare.5 is NOT affected because an upstream fix (commit e6453ef9, Dec 2021) was already included in the upstream release 1.4.6 that TuxCar...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41699",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.4.6-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:72d71d3f-7614-59ea-9a34-f4cf15f44372",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41699 does not affect version 1.4.6-tuxcare.2 of org.springframework.graphql:spring-graphql. Fix 2be20ad0 (gh-1446) ships in upstream 1.4.6; advisory lists affected as 1.4.0-1.4.5",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41700",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.4.6-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cca5b48e-7273-5219-b2c0-4a894882587c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41700 does not affect version 1.4.6-tuxcare.2 of org.springframework.graphql:spring-graphql. Fix c21ee6ec (gh-1452) ships in upstream 1.4.6; advisory lists affected as 1.4.0-1.4.5",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41856",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.4.6-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f19e4b0d-1800-5bc4-aef9-9bb9d71a3dba",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41856 does not affect version 1.4.6-tuxcare.2 of org.springframework.graphql:spring-graphql. Fix c7faaf82 (gh-1469) ships in upstream 1.4.6; advisory lists affected as 1.4.0-1.4.5",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-59285",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.4.6-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5eeb78a0-9848-510b-8267-fdac83bb9889",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-59285 does not affect version 1.4.6-tuxcare.2 of org.springframework.graphql:spring-graphql. Prechecker: No vulnerable code from the fix was found, and none of the calls on the lines the fix removes appear in this version. Version 1.4.6 is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only).",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-59286",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.4.6-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d290e3f6-1b06-531b-9aa3-294b60242ea4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59286 is fixed in version 1.4.6-tuxcare.2 of org.springframework.graphql:spring-graphql."
      }
    },
    {
      "id": "CVE-2026-59287",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.4.6-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:176c2b69-412d-58b3-b652-d47c4a1a04c7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59287 is fixed in version 1.4.6-tuxcare.2 of org.springframework.graphql:spring-graphql."
      }
    },
    {
      "id": "CVE-2026-59288",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.4.6-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4fcd21a2-837e-54f8-a374-60b75027cafb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59288 is fixed in version 1.4.6-tuxcare.2 of org.springframework.graphql:spring-graphql."
      }
    },
    {
      "id": "CVE-2026-59289",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.4.6-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:38352ae9-e4cb-52fa-bb6f-2c5425e6450c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59289 is fixed in version 1.4.6-tuxcare.2 of org.springframework.graphql:spring-graphql."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.4.6-tuxcare.2"
    }
  ]
}