{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4361069f-6a52-5193-935c-fc024d4a5b9a",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-graphql-test",
      "purl": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.9-tuxcare.7",
      "type": "library",
      "group": "org.springframework.graphql",
      "bom-ref": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.9-tuxcare.7",
      "version": "1.2.9-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-graphql-test",
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.9",
            "type": "library",
            "group": "org.springframework.graphql",
            "version": "1.2.9"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-41699",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.9-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:ca5808cc-378c-5d62-9d55-fec2d94d680f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41699 is fixed in version 1.2.9-tuxcare.7 of org.springframework.graphql:spring-graphql-test."
      }
    },
    {
      "id": "CVE-2026-41700",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.9-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:390594bb-e01b-5a00-b342-4d7173be7e1b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41700 is fixed in version 1.2.9-tuxcare.7 of org.springframework.graphql:spring-graphql-test."
      }
    },
    {
      "id": "CVE-2026-41856",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.9-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:d99eed50-79f4-519b-93b3-9bcf5ac7e8b9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41856 is fixed in version 1.2.9-tuxcare.7 of org.springframework.graphql:spring-graphql-test."
      }
    },
    {
      "id": "CVE-2026-59285",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.9-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:8ef4d75d-bdb0-5cbe-9b2a-5cfe0ce35fdb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59285 affects version 1.2.9-tuxcare.7 of org.springframework.graphql:spring-graphql-test."
      }
    },
    {
      "id": "CVE-2026-59286",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.9-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:b8c9ffc8-aba6-5302-a82c-a2af1aadee58",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59286 is fixed in version 1.2.9-tuxcare.7 of org.springframework.graphql:spring-graphql-test."
      }
    },
    {
      "id": "CVE-2026-59287",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.9-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:c2ee1945-163e-5f97-a416-109e3258dd0b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-59287 does not affect version 1.2.9-tuxcare.7 of org.springframework.graphql:spring-graphql-test. not_affected \u2014 Version 1.2.9 is not affected by CVE-2026-59287. The vulnerability requires the WebSocket client's keepAlive feature to be enabled, but this feature does not exist in version 1.2.9. The keepAlive functionality was introduced in version 1.3.x, after version 1.2.9 was released. Exhaustive code analysis confirms no keepAlive configuration option, field, or handler exists in the target version's We...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-59288",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.9-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:48c262df-156c-5cb0-b1d1-eaac5af25963",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59288 is fixed in version 1.2.9-tuxcare.7 of org.springframework.graphql:spring-graphql-test."
      }
    },
    {
      "id": "CVE-2026-59289",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.9-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:dd04993a-cda4-55ee-94bd-fa065c98356a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59289 is fixed in version 1.2.9-tuxcare.7 of org.springframework.graphql:spring-graphql-test."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.graphql/spring-graphql-test@1.2.9-tuxcare.7"
    }
  ]
}