{
  "@id": "urn:uuid:448674c0-7559-4e02-91a4-b2b4010a0ba1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T13:18:07.309625+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.0.6-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.0.6-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-09T13:18:07.309625+00:00",
      "status_notes": "Vulnerability CVE-2023-34047 does not affect version 1.0.6-tuxcare.9 of org.springframework.graphql:spring-graphql. not_affected \u2014 Spring for GraphQL 1.0.6-tuxcare.8 is NOT affected by CVE-2023-34047. The vulnerability involves cross-session context leakage when user-provided DataLoaderOptions are mutated across concurrent requests. The fix (commit e6453ef9, Dec 2021) ensures DataLoaderOptions are copied per-request rather than shared. This upstream fix by Rossen Stoyanchev (rstoyanchev@vmware.com) was already present in t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34047"
      },
      "impact_statement": "not_affected \u2014 Spring for GraphQL 1.0.6-tuxcare.8 is NOT affected by CVE-2023-34047. The vulnerability involves cross-session context leakage when user-provided DataLoaderOptions are mutated across concurrent requests. The fix (commit e6453ef9, Dec 2021) ensures DataLoaderOptions are copied per-request rather than shared. This upstream fix by Rossen Stoyanchev (rstoyanchev@vmware.com) was already present in t..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.0.6-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.0.6-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-09T13:18:07.309625+00:00",
      "status_notes": "Vulnerability CVE-2026-41699 does not affect version 1.0.6-tuxcare.9 of org.springframework.graphql:spring-graphql. Version 1.0.6 is not vulnerable to CVE-2026-41699. The vulnerable JsonKeysetCursorStrategy class with unsafe PolymorphicTypeValidator was introduced in version 1.2.9, which is later than this version. The keyset/scroll pagination feature that enables unsafe deserialization does not exist in version 1.0.6.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41699"
      },
      "impact_statement": "Version 1.0.6 is not vulnerable to CVE-2026-41699. The vulnerable JsonKeysetCursorStrategy class with unsafe PolymorphicTypeValidator was introduced in version 1.2.9, which is later than this version. The keyset/scroll pagination feature that enables unsafe deserialization does not exist in version 1.0.6."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.0.6-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.0.6-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-09T13:18:07.309625+00:00",
      "status_notes": "Vulnerability CVE-2026-41700 is fixed in version 1.0.6-tuxcare.9 of org.springframework.graphql:spring-graphql.",
      "vulnerability": {
        "name": "CVE-2026-41700"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.0.6-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.0.6-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-09T13:18:07.309625+00:00",
      "status_notes": "Vulnerability CVE-2026-41856 is fixed in version 1.0.6-tuxcare.9 of org.springframework.graphql:spring-graphql.",
      "vulnerability": {
        "name": "CVE-2026-41856"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.0.6-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.0.6-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-09T13:18:07.309625+00:00",
      "status_notes": "Vulnerability CVE-2026-59285 does not affect version 1.0.6-tuxcare.9 of org.springframework.graphql:spring-graphql. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 1.0.6 is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59285"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 1.0.6 is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.0.6-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.0.6-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-09T13:18:07.309625+00:00",
      "status_notes": "Vulnerability CVE-2026-59286 is fixed in version 1.0.6-tuxcare.9 of org.springframework.graphql:spring-graphql.",
      "vulnerability": {
        "name": "CVE-2026-59286"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.0.6-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.0.6-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-09T13:18:07.309625+00:00",
      "status_notes": "Vulnerability CVE-2026-59287 does not affect version 1.0.6-tuxcare.9 of org.springframework.graphql:spring-graphql. not_affected \u2014 Version 1.0.6 is NOT affected by CVE-2026-59287. The vulnerability requires the keepAlive feature to be enabled on WebSocketGraphQlClient, but this feature does not exist in version 1.0.6. The keepAlive functionality was introduced in later versions (1.3.x+). Without the ability to configure or process keepAlive intervals, the vulnerability pattern (orphaned Flux.interval subscriptions leading ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59287"
      },
      "impact_statement": "not_affected \u2014 Version 1.0.6 is NOT affected by CVE-2026-59287. The vulnerability requires the keepAlive feature to be enabled on WebSocketGraphQlClient, but this feature does not exist in version 1.0.6. The keepAlive functionality was introduced in later versions (1.3.x+). Without the ability to configure or process keepAlive intervals, the vulnerability pattern (orphaned Flux.interval subscriptions leading ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.0.6-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.0.6-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-09T13:18:07.309625+00:00",
      "status_notes": "Vulnerability CVE-2026-59288 is fixed in version 1.0.6-tuxcare.9 of org.springframework.graphql:spring-graphql.",
      "vulnerability": {
        "name": "CVE-2026-59288"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.0.6-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.0.6-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-11-09T13:18:07.309625+00:00",
      "status_notes": "Vulnerability CVE-2026-59289 does not affect version 1.0.6-tuxcare.9 of org.springframework.graphql:spring-graphql. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 1.0.6 is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59289"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 1.0.6 is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only)."
    }
  ]
}