{
  "@id": "urn:uuid:7b612f1c-d03b-40c2-9a61-5cab226de8a3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T03:19:00.036407+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T03:19:00.036407+00:00",
      "status_notes": "Vulnerability CVE-2023-34047 does not affect version 1.3.5-tuxcare.3 of org.springframework.graphql:spring-graphql. not_affected \u2014 CVE-2023-34047 affects Spring for GraphQL 1.1.0-1.1.5 and 1.2.0-1.2.2, where batch loader context leakage could occur when applications provide DataLoaderOptions during registration. Target version 1.3.5 is not affected because the upstream fix (commit e6453ef9 \"Ensure DataLoaderOptions are per request\") was already included in the 1.3.5 release. The fix ensures fresh DataLoaderOptions instance...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34047"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-34047 affects Spring for GraphQL 1.1.0-1.1.5 and 1.2.0-1.2.2, where batch loader context leakage could occur when applications provide DataLoaderOptions during registration. Target version 1.3.5 is not affected because the upstream fix (commit e6453ef9 \"Ensure DataLoaderOptions are per request\") was already included in the 1.3.5 release. The fix ensures fresh DataLoaderOptions instance..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41699 is fixed in version 1.3.5-tuxcare.3 of org.springframework.graphql:spring-graphql.",
      "vulnerability": {
        "name": "CVE-2026-41699"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41700 is fixed in version 1.3.5-tuxcare.3 of org.springframework.graphql:spring-graphql.",
      "vulnerability": {
        "name": "CVE-2026-41700"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41856 affects version 1.3.5-tuxcare.3 of org.springframework.graphql:spring-graphql, and is fixed in 1.3.5-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41856"
      },
      "action_statement": "Vulnerability CVE-2026-41856 affects version 1.3.5-tuxcare.3 of org.springframework.graphql:spring-graphql, and is fixed in 1.3.5-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:40:55.741562+00:00",
      "status_notes": "Vulnerability CVE-2026-59285 affects version 1.3.5-tuxcare.3 of org.springframework.graphql:spring-graphql.",
      "vulnerability": {
        "name": "CVE-2026-59285"
      },
      "action_statement": "Vulnerability CVE-2026-59285 affects version 1.3.5-tuxcare.3 of org.springframework.graphql:spring-graphql."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59286 is fixed in version 1.3.5-tuxcare.3 of org.springframework.graphql:spring-graphql.",
      "vulnerability": {
        "name": "CVE-2026-59286"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-07T10:48:00.634805+00:00",
      "status_notes": "Vulnerability CVE-2026-59287 affects version 1.3.5-tuxcare.3 of org.springframework.graphql:spring-graphql, and is fixed in 1.3.5-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-59287"
      },
      "action_statement": "Vulnerability CVE-2026-59287 affects version 1.3.5-tuxcare.3 of org.springframework.graphql:spring-graphql, and is fixed in 1.3.5-tuxcare.6."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59288 is fixed in version 1.3.5-tuxcare.3 of org.springframework.graphql:spring-graphql.",
      "vulnerability": {
        "name": "CVE-2026-59288"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.3.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59289 is fixed in version 1.3.5-tuxcare.3 of org.springframework.graphql:spring-graphql.",
      "vulnerability": {
        "name": "CVE-2026-59289"
      }
    }
  ]
}