{
  "@id": "urn:uuid:ee45afcb-20c6-4c7f-807c-41a926dc612e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T19:47:00.071762+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T19:43:20.626818+00:00",
      "status_notes": "Vulnerability CVE-2022-22965 affects version 2.7.9-tuxcare.1 of org.springframework.boot:spring-boot-devtools.",
      "vulnerability": {
        "name": "CVE-2022-22965"
      },
      "action_statement": "Vulnerability CVE-2022-22965 affects version 2.7.9-tuxcare.1 of org.springframework.boot:spring-boot-devtools."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T19:43:20.626818+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 affects version 2.7.9-tuxcare.1 of org.springframework.boot:spring-boot-devtools.",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "action_statement": "Vulnerability CVE-2022-27772 affects version 2.7.9-tuxcare.1 of org.springframework.boot:spring-boot-devtools."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T19:46:00.114050+00:00",
      "status_notes": "Vulnerability CVE-2023-20883 is fixed in version 2.7.9-tuxcare.1 of org.springframework.boot:spring-boot-devtools.",
      "vulnerability": {
        "name": "CVE-2023-20883"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T19:43:20.626818+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 affects version 2.7.9-tuxcare.1 of org.springframework.boot:spring-boot-devtools.",
      "vulnerability": {
        "name": "CVE-2025-22235"
      },
      "action_statement": "Vulnerability CVE-2025-22235 affects version 2.7.9-tuxcare.1 of org.springframework.boot:spring-boot-devtools."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T19:43:20.626818+00:00",
      "status_notes": "Vulnerability CVE-2026-40971 does not affect version 2.7.9-tuxcare.1 of org.springframework.boot:spring-boot-devtools. not_affected \u2014 Spring Boot 2.7.9 is not affected by CVE-2026-40971. The vulnerability is specific to SSL bundle support, a feature introduced in Spring Boot 3.x that does not exist in version 2.7.9. The target only has the traditional SSL properties configuration path, which properly applies hostname verification (defaulting to enabled at line 436 of RabbitProperties.Ssl, applied at line 93 of RabbitConnectio...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40971"
      },
      "impact_statement": "not_affected \u2014 Spring Boot 2.7.9 is not affected by CVE-2026-40971. The vulnerability is specific to SSL bundle support, a feature introduced in Spring Boot 3.x that does not exist in version 2.7.9. The target only has the traditional SSL properties configuration path, which properly applies hostname verification (defaulting to enabled at line 436 of RabbitProperties.Ssl, applied at line 93 of RabbitConnectio..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T19:47:00.071762+00:00",
      "status_notes": "Vulnerability CVE-2026-40972 is fixed in version 2.7.9-tuxcare.1 of org.springframework.boot:spring-boot-devtools.",
      "vulnerability": {
        "name": "CVE-2026-40972"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T19:46:00.114050+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 is fixed in version 2.7.9-tuxcare.1 of org.springframework.boot:spring-boot-devtools.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T19:46:00.114050+00:00",
      "status_notes": "Vulnerability CVE-2026-40974 is fixed in version 2.7.9-tuxcare.1 of org.springframework.boot:spring-boot-devtools.",
      "vulnerability": {
        "name": "CVE-2026-40974"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T19:43:20.626818+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 affects version 2.7.9-tuxcare.1 of org.springframework.boot:spring-boot-devtools.",
      "vulnerability": {
        "name": "CVE-2026-40975"
      },
      "action_statement": "Vulnerability CVE-2026-40975 affects version 2.7.9-tuxcare.1 of org.springframework.boot:spring-boot-devtools."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T19:43:20.626818+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 affects version 2.7.9-tuxcare.1 of org.springframework.boot:spring-boot-devtools.",
      "vulnerability": {
        "name": "CVE-2026-40977"
      },
      "action_statement": "Vulnerability CVE-2026-40977 affects version 2.7.9-tuxcare.1 of org.springframework.boot:spring-boot-devtools."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T19:47:00.071762+00:00",
      "status_notes": "Vulnerability CVE-2026-40992 is fixed in version 2.7.9-tuxcare.1 of org.springframework.boot:spring-boot-devtools.",
      "vulnerability": {
        "name": "CVE-2026-40992"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-devtools@2.7.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T19:43:20.626818+00:00",
      "status_notes": "Vulnerability CVE-2026-41001 affects version 2.7.9-tuxcare.1 of org.springframework.boot:spring-boot-devtools.",
      "vulnerability": {
        "name": "CVE-2026-41001"
      },
      "action_statement": "Vulnerability CVE-2026-41001 affects version 2.7.9-tuxcare.1 of org.springframework.boot:spring-boot-devtools."
    }
  ]
}