{
  "@id": "urn:uuid:46221007-81b6-45a5-bd0a-71aade33e365",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T14:04:51.744136+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2022-22965 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2022-22965"
      },
      "action_statement": "Vulnerability CVE-2022-22965 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "action_statement": "Vulnerability CVE-2022-27772 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:36:14.768306+00:00",
      "status_notes": "Vulnerability CVE-2023-20873 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2023-20873"
      },
      "action_statement": "Vulnerability CVE-2023-20873 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2023-20883 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2023-20883"
      },
      "action_statement": "Vulnerability CVE-2023-20883 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T14:04:51.744136+00:00",
      "status_notes": "Vulnerability CVE-2023-34055 does not affect version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure. not_affected \u2014 CVE-2023-34055 does not affect this Spring Boot 2.7.18-tuxcare.23 build. The vulnerability pattern (accepting arbitrary HTTP method strings causing unbounded metrics tag creation) is not present. The fix validating HTTP methods against the HttpMethod enum and returning constant \"UNKNOWN\" for non-standard methods was already included in upstream Spring Boot v2.7.18, which this TuxCare build is b...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34055"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-34055 does not affect this Spring Boot 2.7.18-tuxcare.23 build. The vulnerability pattern (accepting arbitrary HTTP method strings causing unbounded metrics tag creation) is not present. The fix validating HTTP methods against the HttpMethod enum and returning constant \"UNKNOWN\" for non-standard methods was already included in upstream Spring Boot v2.7.18, which this TuxCare build is b..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-38286 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure, and is fixed in 2.7.18-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2023-38286"
      },
      "action_statement": "Vulnerability CVE-2023-38286 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure, and is fixed in 2.7.18-tuxcare.10."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure, and is fixed in 2.7.18.tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2025-22235"
      },
      "action_statement": "Vulnerability CVE-2025-22235 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure, and is fixed in 2.7.18.tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:36:42.887038+00:00",
      "status_notes": "Vulnerability CVE-2026-22731 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2026-22731"
      },
      "action_statement": "Vulnerability CVE-2026-22731 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22733 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure, and is fixed in 2.7.18-tuxcare.13.",
      "vulnerability": {
        "name": "CVE-2026-22733"
      },
      "action_statement": "Vulnerability CVE-2026-22733 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure, and is fixed in 2.7.18-tuxcare.13."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T06:38:28.033029+00:00",
      "status_notes": "Vulnerability CVE-2026-40971 does not affect version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure. not_affected \u2014 The target Spring Boot version 2.7.18-tuxcare.23 is NOT affected by CVE-2026-40971. The vulnerability specifically affects SSL bundle configuration for RabbitMQ connections, but SSL bundles are a feature that was introduced in Spring Boot 3.2.0-RC1 (commit 5556739c8c). The target version does not have SSL bundle support at all - confirmed by the absence of SslBundleRabbitConnectionFactoryBean.j...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40971"
      },
      "impact_statement": "not_affected \u2014 The target Spring Boot version 2.7.18-tuxcare.23 is NOT affected by CVE-2026-40971. The vulnerability specifically affects SSL bundle configuration for RabbitMQ connections, but SSL bundles are a feature that was introduced in Spring Boot 3.2.0-RC1 (commit 5556739c8c). The target version does not have SSL bundle support at all - confirmed by the absence of SslBundleRabbitConnectionFactoryBean.j..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure, and is fixed in 2.7.18-tuxcare.14.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      },
      "action_statement": "Vulnerability CVE-2026-40973 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure, and is fixed in 2.7.18-tuxcare.14."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40974 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure, and is fixed in 2.7.18-tuxcare.17.",
      "vulnerability": {
        "name": "CVE-2026-40974"
      },
      "action_statement": "Vulnerability CVE-2026-40974 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure, and is fixed in 2.7.18-tuxcare.17."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure, and is fixed in 2.7.18-tuxcare.16.",
      "vulnerability": {
        "name": "CVE-2026-40975"
      },
      "action_statement": "Vulnerability CVE-2026-40975 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure, and is fixed in 2.7.18-tuxcare.16."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:36:42.887038+00:00",
      "status_notes": "Vulnerability CVE-2026-40976 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2026-40976"
      },
      "action_statement": "Vulnerability CVE-2026-40976 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure, and is fixed in 2.7.18-tuxcare.16.",
      "vulnerability": {
        "name": "CVE-2026-40977"
      },
      "action_statement": "Vulnerability CVE-2026-40977 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure, and is fixed in 2.7.18-tuxcare.16."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40992 does not affect version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure. not_affected \u2014 Spring Boot 2.7.18 is NOT AFFECTED by CVE-2026-40992. The vulnerability exists in the SSL auto-configuration feature (spring.mail.ssl.*) introduced in Spring Boot 3.4+/3.5+/4.0+, which does not exist in version 2.7.18. The target version uses a simpler architecture where all SSL configuration is manual via spring.mail.properties.*, and the auto-configuration does not handle SSL at all.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40992"
      },
      "impact_statement": "not_affected \u2014 Spring Boot 2.7.18 is NOT AFFECTED by CVE-2026-40992. The vulnerability exists in the SSL auto-configuration feature (spring.mail.ssl.*) introduced in Spring Boot 3.4+/3.5+/4.0+, which does not exist in version 2.7.18. The target version uses a simpler architecture where all SSL configuration is manual via spring.mail.properties.*, and the auto-configuration does not handle SSL at all."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@2.7.18.tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41001 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure, and is fixed in 2.7.18-tuxcare.19.",
      "vulnerability": {
        "name": "CVE-2026-41001"
      },
      "action_statement": "Vulnerability CVE-2026-41001 affects version 2.7.18.tuxcare.1 of org.springframework.boot:spring-boot-actuator-autoconfigure, and is fixed in 2.7.18-tuxcare.19."
    }
  ]
}