{
  "@id": "urn:uuid:3d969d2e-f232-4c2c-bf1f-64ddfd3146e6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T14:11:55.158938+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2022-22965 affects version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2022-22965"
      },
      "action_statement": "Vulnerability CVE-2022-22965 affects version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 affects version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "action_statement": "Vulnerability CVE-2022-27772 affects version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T00:36:14.768306+00:00",
      "status_notes": "Vulnerability CVE-2023-20873 affects version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2023-20873"
      },
      "action_statement": "Vulnerability CVE-2023-20873 affects version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:21:49.480044+00:00",
      "status_notes": "Vulnerability CVE-2023-20883 affects version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2023-20883"
      },
      "action_statement": "Vulnerability CVE-2023-20883 affects version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T14:11:55.158938+00:00",
      "status_notes": "Vulnerability CVE-2023-34055 does not affect version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure. not_affected \u2014 Spring Boot 3.4.13 is not affected by CVE-2023-34055. The vulnerable WebMvcTags and WebFluxTags classes that used raw HTTP method strings for metrics tags were removed in Spring Boot 3.2 (June 2023, commit b645eb32ac) before the CVE was discovered. Version 3.4.13 uses Spring Framework's Observation API (DefaultServerRequestObservationConvention) for HTTP metrics, which is a different architectu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34055"
      },
      "impact_statement": "not_affected \u2014 Spring Boot 3.4.13 is not affected by CVE-2023-34055. The vulnerable WebMvcTags and WebFluxTags classes that used raw HTTP method strings for metrics tags were removed in Spring Boot 3.2 (June 2023, commit b645eb32ac) before the CVE was discovered. Version 3.4.13 uses Spring Framework's Observation API (DefaultServerRequestObservationConvention) for HTTP metrics, which is a different architectu..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T18:32:37.090382+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 affects version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2025-22235"
      },
      "action_statement": "Vulnerability CVE-2025-22235 affects version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22731 is fixed in version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2026-22731"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22733 is fixed in version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2026-22733"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T06:49:41.365843+00:00",
      "status_notes": "Vulnerability CVE-2026-40971 does not affect version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure. not_affected \u2014 The target version (3.4.13-tuxcare.3) does not contain the vulnerable code path addressed by CVE-2026-40971. The vulnerability was introduced in upstream commit e26ccbe028 which added a `connectionDetails.getSslBundle()` API that failed to apply hostname verification. This commit is not in the target's ancestry. The target only has the `ssl.getBundle()` API (from commit 5556739c8c) which correc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40971"
      },
      "impact_statement": "not_affected \u2014 The target version (3.4.13-tuxcare.3) does not contain the vulnerable code path addressed by CVE-2026-40971. The vulnerability was introduced in upstream commit e26ccbe028 which added a `connectionDetails.getSslBundle()` API that failed to apply hostname verification. This commit is not in the target's ancestry. The target only has the `ssl.getBundle()` API (from commit 5556739c8c) which correc..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 is fixed in version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40974 affects version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2026-40974"
      },
      "action_statement": "Vulnerability CVE-2026-40974 affects version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 affects version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2026-40975"
      },
      "action_statement": "Vulnerability CVE-2026-40975 affects version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T18:36:42.887038+00:00",
      "status_notes": "Vulnerability CVE-2026-40976 affects version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2026-40976"
      },
      "action_statement": "Vulnerability CVE-2026-40976 affects version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 affects version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure, and is fixed in 3.4.13-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-40977"
      },
      "action_statement": "Vulnerability CVE-2026-40977 affects version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure, and is fixed in 3.4.13-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40992 affects version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure, and is fixed in 3.4.13-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-40992"
      },
      "action_statement": "Vulnerability CVE-2026-40992 affects version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure, and is fixed in 3.4.13-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41001 affects version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure, and is fixed in 3.4.13-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-41001"
      },
      "action_statement": "Vulnerability CVE-2026-41001 affects version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure, and is fixed in 3.4.13-tuxcare.3."
    }
  ]
}