{
  "@id": "urn:uuid:59bdb570-74e1-496d-ba79-ecf0f2e1f3cd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T14:08:25.182757+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:59:58.436178+00:00",
      "status_notes": "Vulnerability CVE-2022-22965 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator.",
      "vulnerability": {
        "name": "CVE-2022-22965"
      },
      "action_statement": "Vulnerability CVE-2022-22965 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:37:14.382670+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator.",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "action_statement": "Vulnerability CVE-2022-27772 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T00:36:14.768306+00:00",
      "status_notes": "Vulnerability CVE-2023-20873 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator.",
      "vulnerability": {
        "name": "CVE-2023-20873"
      },
      "action_statement": "Vulnerability CVE-2023-20873 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:26:53.294923+00:00",
      "status_notes": "Vulnerability CVE-2023-20883 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator.",
      "vulnerability": {
        "name": "CVE-2023-20883"
      },
      "action_statement": "Vulnerability CVE-2023-20883 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T14:08:25.182757+00:00",
      "status_notes": "Vulnerability CVE-2023-34055 does not affect version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator. not_affected \u2014 Spring Boot 3.2.12 is not affected by CVE-2023-34055. The vulnerable classes WebFluxTags.java and WebMvcTags.java, which created unbounded Tag instances for arbitrary HTTP method names, were architecturally removed in Spring Boot 3.2.x during the migration to the Micrometer Observation API (commit b645eb32ac, June 2023). The CVE affects versions 2.7.0-2.7.17, 3.0.0-3.0.12, and 3.1.0-3.1.5, all ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34055"
      },
      "impact_statement": "not_affected \u2014 Spring Boot 3.2.12 is not affected by CVE-2023-34055. The vulnerable classes WebFluxTags.java and WebMvcTags.java, which created unbounded Tag instances for arbitrary HTTP method names, were architecturally removed in Spring Boot 3.2.x during the migration to the Micrometer Observation API (commit b645eb32ac, June 2023). The CVE affects versions 2.7.0-2.7.17, 3.0.0-3.0.12, and 3.1.0-3.1.5, all ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 is fixed in version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator.",
      "vulnerability": {
        "name": "CVE-2025-22235"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:36:42.887038+00:00",
      "status_notes": "Vulnerability CVE-2026-22731 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator.",
      "vulnerability": {
        "name": "CVE-2026-22731"
      },
      "action_statement": "Vulnerability CVE-2026-22731 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22733 is fixed in version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator.",
      "vulnerability": {
        "name": "CVE-2026-22733"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:40:55.741562+00:00",
      "status_notes": "Vulnerability CVE-2026-40971 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator.",
      "vulnerability": {
        "name": "CVE-2026-40971"
      },
      "action_statement": "Vulnerability CVE-2026-40971 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:36:42.887038+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      },
      "action_statement": "Vulnerability CVE-2026-40973 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T12:55:53.554317+00:00",
      "status_notes": "Vulnerability CVE-2026-40974 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator, and is fixed in 3.2.12-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-40974"
      },
      "action_statement": "Vulnerability CVE-2026-40974 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator, and is fixed in 3.2.12-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T12:55:53.554317+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator, and is fixed in 3.2.12-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-40975"
      },
      "action_statement": "Vulnerability CVE-2026-40975 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator, and is fixed in 3.2.12-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:36:42.887038+00:00",
      "status_notes": "Vulnerability CVE-2026-40976 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator.",
      "vulnerability": {
        "name": "CVE-2026-40976"
      },
      "action_statement": "Vulnerability CVE-2026-40976 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-13T17:18:00.098046+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator.",
      "vulnerability": {
        "name": "CVE-2026-40977"
      },
      "action_statement": "Vulnerability CVE-2026-40977 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40992 does not affect version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator. not_affected \u2014 Spring Boot 3.2.12 is not affected by CVE-2026-40992. The vulnerability concerns incomplete SSL auto-configuration (enabling SSL without hostname verification) in Spring Boot's mail module, introduced in version 3.4.0 with the MailProperties.Ssl class and related auto-configuration logic. Version 3.2.12 predates this feature and has no SSL auto-configuration for mail - it only passes through us...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40992"
      },
      "impact_statement": "not_affected \u2014 Spring Boot 3.2.12 is not affected by CVE-2026-40992. The vulnerability concerns incomplete SSL auto-configuration (enabling SSL without hostname verification) in Spring Boot's mail module, introduced in version 3.4.0 with the MailProperties.Ssl class and related auto-configuration logic. Version 3.2.12 predates this feature and has no SSL auto-configuration for mail - it only passes through us..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.2.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-26T12:55:53.554317+00:00",
      "status_notes": "Vulnerability CVE-2026-41001 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator, and is fixed in 3.2.12-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-41001"
      },
      "action_statement": "Vulnerability CVE-2026-41001 affects version 3.2.12-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator, and is fixed in 3.2.12-tuxcare.5."
    }
  ]
}