{
  "@id": "urn:uuid:c723b4e5-9e9c-4f9d-9be3-a0025d49dad6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T03:19:31.735573+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.9-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.9-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T03:19:31.735573+00:00",
      "status_notes": "Vulnerability CVE-2023-34047 does not affect version 1.2.9-tuxcare.4 of org.springframework.graphql:spring-graphql. not_affected \u2014 CVE-2023-34047 affects Spring for GraphQL versions 1.1.0-1.1.5 and 1.2.0-1.2.2. The vulnerability allows batch loader functions to be exposed to GraphQL context values from different user sessions when a DataLoaderOptions instance is provided during registration. The target version 1.2.9 is NOT affected because the upstream fix was already applied in version 1.2.3 (commit a079d442, September 20...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34047"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-34047 affects Spring for GraphQL versions 1.1.0-1.1.5 and 1.2.0-1.2.2. The vulnerability allows batch loader functions to be exposed to GraphQL context values from different user sessions when a DataLoaderOptions instance is provided during registration. The target version 1.2.9 is NOT affected because the upstream fix was already applied in version 1.2.3 (commit a079d442, September 20..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.9-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.9-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41699 affects version 1.2.9-tuxcare.4 of org.springframework.graphql:spring-graphql, and is fixed in 1.2.9-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-41699"
      },
      "action_statement": "Vulnerability CVE-2026-41699 affects version 1.2.9-tuxcare.4 of org.springframework.graphql:spring-graphql, and is fixed in 1.2.9-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.9-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.9-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41700 affects version 1.2.9-tuxcare.4 of org.springframework.graphql:spring-graphql, and is fixed in 1.2.9-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-41700"
      },
      "action_statement": "Vulnerability CVE-2026-41700 affects version 1.2.9-tuxcare.4 of org.springframework.graphql:spring-graphql, and is fixed in 1.2.9-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.9-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.9-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41856 affects version 1.2.9-tuxcare.4 of org.springframework.graphql:spring-graphql, and is fixed in 1.2.9-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-41856"
      },
      "action_statement": "Vulnerability CVE-2026-41856 affects version 1.2.9-tuxcare.4 of org.springframework.graphql:spring-graphql, and is fixed in 1.2.9-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.9-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.9-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T18:40:55.741562+00:00",
      "status_notes": "Vulnerability CVE-2026-59285 affects version 1.2.9-tuxcare.4 of org.springframework.graphql:spring-graphql.",
      "vulnerability": {
        "name": "CVE-2026-59285"
      },
      "action_statement": "Vulnerability CVE-2026-59285 affects version 1.2.9-tuxcare.4 of org.springframework.graphql:spring-graphql."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.9-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.9-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59286 affects version 1.2.9-tuxcare.4 of org.springframework.graphql:spring-graphql, and is fixed in 1.2.9-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-59286"
      },
      "action_statement": "Vulnerability CVE-2026-59286 affects version 1.2.9-tuxcare.4 of org.springframework.graphql:spring-graphql, and is fixed in 1.2.9-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.9-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.9-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2026-59287 does not affect version 1.2.9-tuxcare.4 of org.springframework.graphql:spring-graphql. not_affected \u2014 Version 1.2.9 is not affected by CVE-2026-59287. The vulnerability requires the WebSocket client's keepAlive feature to be enabled, but this feature does not exist in version 1.2.9. The keepAlive functionality was introduced in version 1.3.x, after version 1.2.9 was released. Exhaustive code analysis confirms no keepAlive configuration option, field, or handler exists in the target version's We...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59287"
      },
      "impact_statement": "not_affected \u2014 Version 1.2.9 is not affected by CVE-2026-59287. The vulnerability requires the WebSocket client's keepAlive feature to be enabled, but this feature does not exist in version 1.2.9. The keepAlive functionality was introduced in version 1.3.x, after version 1.2.9 was released. Exhaustive code analysis confirms no keepAlive configuration option, field, or handler exists in the target version's We..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.9-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.9-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59288 affects version 1.2.9-tuxcare.4 of org.springframework.graphql:spring-graphql, and is fixed in 1.2.9-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-59288"
      },
      "action_statement": "Vulnerability CVE-2026-59288 affects version 1.2.9-tuxcare.4 of org.springframework.graphql:spring-graphql, and is fixed in 1.2.9-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.9-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.2.9-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59289 affects version 1.2.9-tuxcare.4 of org.springframework.graphql:spring-graphql, and is fixed in 1.2.9-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-59289"
      },
      "action_statement": "Vulnerability CVE-2026-59289 affects version 1.2.9-tuxcare.4 of org.springframework.graphql:spring-graphql, and is fixed in 1.2.9-tuxcare.5."
    }
  ]
}