{
  "@id": "urn:uuid:6479fea8-a337-4c1a-9c7f-bfc020d6bc29",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-08T22:17:10.950440+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.graphql-java/graphql-java@18.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.graphql-java/graphql-java@18.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T22:17:10.950440+00:00",
      "status_notes": "Vulnerability CVE-2022-37734 does not affect version 18.5-tuxcare.1 of com.graphql-java:graphql-java. The target repository (graphql-java version 18.5 at SHA 9ab53b7bcf827bce59db348a78d1fb6bccb3e537) is not affected by CVE-2022-37734. The vulnerability's fix\u2014which adds token counting limits (15,000 grammar tokens, 200,000 whitespace tokens) via SafeTokenSource to prevent CPU exhaustion during GraphQL query parsing\u2014was already present in the upstream release 18.5 that TuxCare onboarded. The fix commit 0256fd0627148e5b71218e424c310f48b066a041 by Brad Baker (bbaker@atlassian.com) is an ancestor of TuxCare's first commit (2f49c9688e53c11f7d2559548b7aafb39e789ed9 \"Onboard version 18.5\"), confirming the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 17.4; >= 18.0, < 18.3), NVD (< 17.4; >= 18.0, < 18.3), Snyk (< 0.0.0-2022-07-26T05-45-04-226aabd9; >= 17.0, < 17.4; >= 18.0, < 18.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-37734"
      },
      "impact_statement": "The target repository (graphql-java version 18.5 at SHA 9ab53b7bcf827bce59db348a78d1fb6bccb3e537) is not affected by CVE-2022-37734. The vulnerability's fix\u2014which adds token counting limits (15,000 grammar tokens, 200,000 whitespace tokens) via SafeTokenSource to prevent CPU exhaustion during GraphQL query parsing\u2014was already present in the upstream release 18.5 that TuxCare onboarded. The fix commit 0256fd0627148e5b71218e424c310f48b066a041 by Brad Baker (bbaker@atlassian.com) is an ancestor of TuxCare's first commit (2f49c9688e53c11f7d2559548b7aafb39e789ed9 \"Onboard version 18.5\"), confirming the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 17.4; >= 18.0, < 18.3), NVD (< 17.4; >= 18.0, < 18.3), Snyk (< 0.0.0-2022-07-26T05-45-04-226aabd9; >= 17.0, < 17.4; >= 18.0, < 18.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.graphql-java/graphql-java@18.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.graphql-java/graphql-java@18.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T22:17:10.950440+00:00",
      "status_notes": "Vulnerability CVE-2023-28867 does not affect version 18.5-tuxcare.1 of com.graphql-java:graphql-java. Prechecker: The upstream fix is already in this version's source history (commit 3e2ccea4). No affected range in the advisories covers version 18.5. Advisories: GitHub GHSA-p4qx-6w5p-4rj2 (no listed range covers this version), NVD (no listed range covers this version), Snyk (no listed range covers this version).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-28867"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commit 3e2ccea4). No affected range in the advisories covers version 18.5. Advisories: GitHub GHSA-p4qx-6w5p-4rj2 (no listed range covers this version), NVD (no listed range covers this version), Snyk (no listed range covers this version)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/com.graphql-java/graphql-java@18.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.graphql-java/graphql-java@18.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-08T22:17:10.950440+00:00",
      "status_notes": "Vulnerability CVE-2024-40094 affects version 18.5-tuxcare.1 of com.graphql-java:graphql-java.",
      "vulnerability": {
        "name": "CVE-2024-40094"
      },
      "action_statement": "Vulnerability CVE-2024-40094 affects version 18.5-tuxcare.1 of com.graphql-java:graphql-java."
    }
  ]
}