{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:5c550dae-e6f9-5304-b03f-eae1baaa8437",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-graphql-test",
      "purl": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.4-tuxcare.1",
      "type": "library",
      "group": "org.springframework.graphql",
      "bom-ref": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.4-tuxcare.1",
      "version": "1.2.4-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-graphql-test",
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.4",
            "type": "library",
            "group": "org.springframework.graphql",
            "version": "1.2.4"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-41699",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4b81894a-3fd9-51ea-9f0c-0c0c0223b4e9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41699 is fixed in version 1.2.4-tuxcare.1 of org.springframework.graphql:spring-graphql-test."
      }
    },
    {
      "id": "CVE-2026-41700",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b8c63234-977f-5798-ae44-c2482dfb449b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41700 is fixed in version 1.2.4-tuxcare.1 of org.springframework.graphql:spring-graphql-test."
      }
    },
    {
      "id": "CVE-2026-41856",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:46f99d8e-fcbf-559e-9245-460950042974",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41856 is fixed in version 1.2.4-tuxcare.1 of org.springframework.graphql:spring-graphql-test."
      }
    },
    {
      "id": "CVE-2026-59285",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6dbcc33e-3b15-53ef-be5f-170ff53777e0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59285 affects version 1.2.4-tuxcare.1 of org.springframework.graphql:spring-graphql-test."
      }
    },
    {
      "id": "CVE-2026-59286",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ca9acfe1-07e5-594c-a746-5ee57c9196bc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59286 is fixed in version 1.2.4-tuxcare.1 of org.springframework.graphql:spring-graphql-test."
      }
    },
    {
      "id": "CVE-2026-59287",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5becd568-b6ea-59ff-8e4d-0283225b2892",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-59287 does not affect version 1.2.4-tuxcare.1 of org.springframework.graphql:spring-graphql-test. not_affected \u2014 Spring GraphQL version 1.2.4 is not affected by CVE-2026-59287. The vulnerability requires the keepAlive feature in WebSocketGraphQlClient, which was introduced in version 1.3.5 (commit 3f5fc1a5, February 2023) and does not exist in version 1.2.4. Without the keepAlive feature, the duplicate keepAlive handler vulnerability pattern cannot manifest. Exhaustive searches confirmed no keepAlive conf...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-59288",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2ccc0435-2397-53d2-bdbf-de4fe98a3607",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59288 is fixed in version 1.2.4-tuxcare.1 of org.springframework.graphql:spring-graphql-test."
      }
    },
    {
      "id": "CVE-2026-59289",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.4-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8b4156ca-e345-5ba8-af65-aff66dbaf403",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59289 is fixed in version 1.2.4-tuxcare.1 of org.springframework.graphql:spring-graphql-test."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.4-tuxcare.1"
    }
  ]
}