{
  "@id": "urn:uuid:625f10bd-45d5-4ad1-b70e-b09902c051cb",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-docker-compose@3.5.16-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-docker-compose@3.5.16-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2022-22965 affects version 3.5.16-tuxcare.6 of org.springframework.boot:spring-boot-docker-compose.",
      "vulnerability": {
        "name": "CVE-2022-22965"
      },
      "action_statement": "Vulnerability CVE-2022-22965 affects version 3.5.16-tuxcare.6 of org.springframework.boot:spring-boot-docker-compose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-docker-compose@3.5.16-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-docker-compose@3.5.16-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 affects version 3.5.16-tuxcare.6 of org.springframework.boot:spring-boot-docker-compose.",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "action_statement": "Vulnerability CVE-2022-27772 affects version 3.5.16-tuxcare.6 of org.springframework.boot:spring-boot-docker-compose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-docker-compose@3.5.16-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-docker-compose@3.5.16-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-28T18:32:37.090382+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 affects version 3.5.16-tuxcare.6 of org.springframework.boot:spring-boot-docker-compose.",
      "vulnerability": {
        "name": "CVE-2025-22235"
      },
      "action_statement": "Vulnerability CVE-2025-22235 affects version 3.5.16-tuxcare.6 of org.springframework.boot:spring-boot-docker-compose."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-docker-compose@3.5.16-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-docker-compose@3.5.16-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-28T18:36:42.887038+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 affects version 3.5.16-tuxcare.6 of org.springframework.boot:spring-boot-docker-compose.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      },
      "action_statement": "Vulnerability CVE-2026-40973 affects version 3.5.16-tuxcare.6 of org.springframework.boot:spring-boot-docker-compose."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-docker-compose@3.5.16-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-docker-compose@3.5.16-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-29T06:32:14.253219+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 does not affect version 3.5.16-tuxcare.6 of org.springframework.boot:spring-boot-docker-compose. not_affected \u2014 The target repository version 3.5.16-tuxcare.8 is NOT affected by CVE-2026-40975. The vulnerability concerns weak random number generation in Spring Boot's RandomValuePropertySource class, which historically used java.util.Random instead of java.security.SecureRandom for ${random.*} configuration placeholders. The fix (replacing Random with SecureRandom) was already present in upstream Spring B...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40975"
      },
      "impact_statement": "not_affected \u2014 The target repository version 3.5.16-tuxcare.8 is NOT affected by CVE-2026-40975. The vulnerability concerns weak random number generation in Spring Boot's RandomValuePropertySource class, which historically used java.util.Random instead of java.security.SecureRandom for ${random.*} configuration placeholders. The fix (replacing Random with SecureRandom) was already present in upstream Spring B..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-docker-compose@3.5.16-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-docker-compose@3.5.16-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-29T06:08:36.782808+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 does not affect version 3.5.16-tuxcare.6 of org.springframework.boot:spring-boot-docker-compose. not_affected \u2014 CVE-2026-40977 is not present in Spring Boot 3.5.16-tuxcare.8. The vulnerability, which allowed local attackers to corrupt arbitrary files via symlink attacks when ApplicationPidFileWriter is configured, was fixed in the upstream Spring Boot 3.5.16 release before TuxCare onboarded it. The fix (commit f533a4549c by Andy Wilkinson from Broadcom) added LinkOption.NOFOLLOW_LINKS to prevent symlink ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40977"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-40977 is not present in Spring Boot 3.5.16-tuxcare.8. The vulnerability, which allowed local attackers to corrupt arbitrary files via symlink attacks when ApplicationPidFileWriter is configured, was fixed in the upstream Spring Boot 3.5.16 release before TuxCare onboarded it. The fix (commit f533a4549c by Andy Wilkinson from Broadcom) added LinkOption.NOFOLLOW_LINKS to prevent symlink ..."
    }
  ]
}