{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:9f68a733-88e6-5fb7-a710-8899f38e78f3",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-graphql",
      "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.3",
      "type": "library",
      "group": "org.springframework.graphql",
      "bom-ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.3",
      "version": "1.1.7-tuxcare.3",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-graphql",
            "purl": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7",
            "type": "library",
            "group": "org.springframework.graphql",
            "version": "1.1.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2026-41699",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:50aac9fa-fdf6-54bb-bdcd-f153f8e77ed6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41699 does not affect version 1.1.7-tuxcare.3 of org.springframework.graphql:spring-graphql. Spring GraphQL v1.1.7 is not affected by CVE-2026-41699. The vulnerable component (JsonKeysetCursorStrategy with unsafe polymorphic deserialization) does not exist in this version. The pagination feature with cursor-based scrolling was introduced in v1.2.0 (March 2023), while v1.1.7 is from the earlier 1.1.x maintenance branch that predates this functionality.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41700",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:c95eb4d7-234d-5222-b4f7-1a36721b85f5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41700 is fixed in version 1.1.7-tuxcare.3 of org.springframework.graphql:spring-graphql."
      }
    },
    {
      "id": "CVE-2026-41856",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:ae0937e2-c2b7-557f-b973-aab9e1f8628a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41856 is fixed in version 1.1.7-tuxcare.3 of org.springframework.graphql:spring-graphql."
      }
    },
    {
      "id": "CVE-2026-59285",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:45fc63d9-f941-5cc7-8eb5-2ed564167ad2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59285 affects version 1.1.7-tuxcare.3 of org.springframework.graphql:spring-graphql."
      }
    },
    {
      "id": "CVE-2026-59286",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:911dffd2-63e5-5be3-84ef-543be88f3baa",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59286 is fixed in version 1.1.7-tuxcare.3 of org.springframework.graphql:spring-graphql."
      }
    },
    {
      "id": "CVE-2026-59287",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:f1ab85dc-aae0-524d-a5d2-f574808878fc",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-59287 does not affect version 1.1.7-tuxcare.3 of org.springframework.graphql:spring-graphql. not_affected \u2014 Version 1.1.7 is NOT AFFECTED by CVE-2026-59287. The vulnerability requires the WebSocket client keepAlive feature to be enabled, but this feature does not exist in version 1.1.7. The keepAlive feature was introduced in commit 3f5fc1a5 (Feb 8, 2023) and first released in v1.3.0-RC1. Version 1.1.7 is on the 1.1.x maintenance branch and predates this feature. Exhaustive search confirms zero keepA...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-59288",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:6348ee26-b127-54ff-87cc-850d1e238693",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59288 is fixed in version 1.1.7-tuxcare.3 of org.springframework.graphql:spring-graphql."
      }
    },
    {
      "id": "CVE-2026-59289",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.3"
        }
      ],
      "bom-ref": "urn:uuid:535274a8-5d21-53ae-b1d9-8ea9d8a74e3b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-59289 affects version 1.1.7-tuxcare.3 of org.springframework.graphql:spring-graphql."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.graphql/spring-graphql@1.1.7-tuxcare.3"
    }
  ]
}