{
  "@id": "urn:uuid:3797f418-e021-4689-a906-d73e59e2ec5a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.graphql-java/graphql-java@24.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.graphql-java/graphql-java@24.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2022-37734 does not affect version 24.3-tuxcare.1 of com.graphql-java:graphql-java. The target repository (graphql-java version 24.3-tuxcare.1) is not affected by CVE-2022-37734. The vulnerability allowed attackers to cause CPU exhaustion through malicious GraphQL queries with excessive tokens or whitespace. The fix was already present in the upstream graphql-java release that TuxCare onboarded. Commit 226aabd9 (authored by Brad Baker, bbaker@atlassian.com) introduced SafeTokenSource, a defense mechanism that limits token processing to 15,000 grammar tokens and 200,000 whitespace tokens by default, throwing ParseCancelledException when limits are exceeded. This fix shipped with the upstream release and was not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 17.4; >= 18.0, < 18.3), NVD (< 17.4; >= 18.0, < 18.3), Snyk (< 0.0.0-2022-07-26T05-45-04-226aabd9; >= 17.0, < 17.4; >= 18.0, < 18.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-37734"
      },
      "impact_statement": "The target repository (graphql-java version 24.3-tuxcare.1) is not affected by CVE-2022-37734. The vulnerability allowed attackers to cause CPU exhaustion through malicious GraphQL queries with excessive tokens or whitespace. The fix was already present in the upstream graphql-java release that TuxCare onboarded. Commit 226aabd9 (authored by Brad Baker, bbaker@atlassian.com) introduced SafeTokenSource, a defense mechanism that limits token processing to 15,000 grammar tokens and 200,000 whitespace tokens by default, throwing ParseCancelledException when limits are exceeded. This fix shipped with the upstream release and was not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 17.4; >= 18.0, < 18.3), NVD (< 17.4; >= 18.0, < 18.3), Snyk (< 0.0.0-2022-07-26T05-45-04-226aabd9; >= 17.0, < 17.4; >= 18.0, < 18.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.graphql-java/graphql-java@24.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.graphql-java/graphql-java@24.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2023-28867 does not affect version 24.3-tuxcare.1 of com.graphql-java:graphql-java. CVE-2023-28867 (stack overflow via deeply nested GraphQL queries) is not present in graphql-java 24.3. The vulnerability was fixed by upstream commit 8a1c884c (March 2023) which added MAX_RULE_DEPTH limiting (default 500) and depth tracking in the ANTLR parser listener. This fix was already present in the upstream release that TuxCare onboarded in September 2026, over 3 years after the upstream fix. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 0.0.0-2023-03-20T01-49-44-80e3135; >= 1.2, < 17.5; >= 18.0, < 18.4; >= 19.0, < 19.4; >= 20.0, < 20.1), NVD (< 17.5; >= 18.0, < 18.4; >= 19.0, < 19.4; = 20.0), Snyk (< 0.0.0-2023-03-20T01-49-44-80e3135; >= 1.2, < 17.5; >= 18.0, < 18.4; >= 19.0, < 19.4; >= 20.0, < 20.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-28867"
      },
      "impact_statement": "CVE-2023-28867 (stack overflow via deeply nested GraphQL queries) is not present in graphql-java 24.3. The vulnerability was fixed by upstream commit 8a1c884c (March 2023) which added MAX_RULE_DEPTH limiting (default 500) and depth tracking in the ANTLR parser listener. This fix was already present in the upstream release that TuxCare onboarded in September 2026, over 3 years after the upstream fix. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 0.0.0-2023-03-20T01-49-44-80e3135; >= 1.2, < 17.5; >= 18.0, < 18.4; >= 19.0, < 19.4; >= 20.0, < 20.1), NVD (< 17.5; >= 18.0, < 18.4; >= 19.0, < 19.4; = 20.0), Snyk (< 0.0.0-2023-03-20T01-49-44-80e3135; >= 1.2, < 17.5; >= 18.0, < 18.4; >= 19.0, < 19.4; >= 20.0, < 20.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/com.graphql-java/graphql-java@24.3-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/com.graphql-java/graphql-java@24.3-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T22:21:49.570496+00:00",
      "status_notes": "Vulnerability CVE-2024-40094 does not affect version 24.3-tuxcare.1 of com.graphql-java:graphql-java. not_affected \u2014 Target version 24.3 is NOT affected by CVE-2024-40094. The vulnerability (denial of service via unlimited ExecutableNormalizedField creation during introspection queries) is not present because the upstream vendor fix was already included in the graphql-java 24.3 release that TuxCare onboarded. The fix limits ENF creation to 500 fields and 20 depth for introspection queries, enforced in GoodFai...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-40094"
      },
      "impact_statement": "not_affected \u2014 Target version 24.3 is NOT affected by CVE-2024-40094. The vulnerability (denial of service via unlimited ExecutableNormalizedField creation during introspection queries) is not present because the upstream vendor fix was already included in the graphql-java 24.3 release that TuxCare onboarded. The fix limits ENF creation to 500 fields and 20 depth for introspection queries, enforced in GoodFai..."
    }
  ]
}