{
  "@id": "urn:uuid:efa6cfc5-8287-4adf-957d-e2093dbd4cf9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-29T15:30:49.741847+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.7.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.7.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T11:51:30.356687+00:00",
      "status_notes": "Vulnerability CVE-2022-22965 affects version 2.7.7-tuxcare.1 of org.springframework.boot:spring-boot-starter-mail.",
      "vulnerability": {
        "name": "CVE-2022-22965"
      },
      "action_statement": "Vulnerability CVE-2022-22965 affects version 2.7.7-tuxcare.1 of org.springframework.boot:spring-boot-starter-mail."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.7.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.7.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T11:51:30.356687+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 affects version 2.7.7-tuxcare.1 of org.springframework.boot:spring-boot-starter-mail.",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "action_statement": "Vulnerability CVE-2022-27772 affects version 2.7.7-tuxcare.1 of org.springframework.boot:spring-boot-starter-mail."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.7.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.7.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T11:51:30.356687+00:00",
      "status_notes": "Vulnerability CVE-2023-20883 affects version 2.7.7-tuxcare.1 of org.springframework.boot:spring-boot-starter-mail.",
      "vulnerability": {
        "name": "CVE-2023-20883"
      },
      "action_statement": "Vulnerability CVE-2023-20883 affects version 2.7.7-tuxcare.1 of org.springframework.boot:spring-boot-starter-mail."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.7.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.7.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T11:51:30.356687+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 affects version 2.7.7-tuxcare.1 of org.springframework.boot:spring-boot-starter-mail.",
      "vulnerability": {
        "name": "CVE-2025-22235"
      },
      "action_statement": "Vulnerability CVE-2025-22235 affects version 2.7.7-tuxcare.1 of org.springframework.boot:spring-boot-starter-mail."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.7.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.7.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T11:51:30.356687+00:00",
      "status_notes": "Vulnerability CVE-2026-40971 does not affect version 2.7.7-tuxcare.1 of org.springframework.boot:spring-boot-starter-mail. not_affected \u2014 Spring Boot 2.7.7 is NOT affected by CVE-2026-40971. The vulnerability exists specifically in Spring Boot 3.x's SSL bundle configuration feature, which does not exist in the 2.7.x series. The target only supports SSL configuration via properties (not SSL bundles), and this path correctly applies hostname verification with a secure default (verifyHostname=true).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40971"
      },
      "impact_statement": "not_affected \u2014 Spring Boot 2.7.7 is NOT affected by CVE-2026-40971. The vulnerability exists specifically in Spring Boot 3.x's SSL bundle configuration feature, which does not exist in the 2.7.x series. The target only supports SSL configuration via properties (not SSL bundles), and this path correctly applies hostname verification with a secure default (verifyHostname=true)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.7.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.7.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T11:51:30.356687+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 affects version 2.7.7-tuxcare.1 of org.springframework.boot:spring-boot-starter-mail.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      },
      "action_statement": "Vulnerability CVE-2026-40973 affects version 2.7.7-tuxcare.1 of org.springframework.boot:spring-boot-starter-mail."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.7.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.7.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T11:51:30.356687+00:00",
      "status_notes": "Vulnerability CVE-2026-40974 affects version 2.7.7-tuxcare.1 of org.springframework.boot:spring-boot-starter-mail.",
      "vulnerability": {
        "name": "CVE-2026-40974"
      },
      "action_statement": "Vulnerability CVE-2026-40974 affects version 2.7.7-tuxcare.1 of org.springframework.boot:spring-boot-starter-mail."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.7.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.7.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T11:51:30.356687+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 affects version 2.7.7-tuxcare.1 of org.springframework.boot:spring-boot-starter-mail.",
      "vulnerability": {
        "name": "CVE-2026-40975"
      },
      "action_statement": "Vulnerability CVE-2026-40975 affects version 2.7.7-tuxcare.1 of org.springframework.boot:spring-boot-starter-mail."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.7.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.7.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T11:51:30.356687+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 affects version 2.7.7-tuxcare.1 of org.springframework.boot:spring-boot-starter-mail.",
      "vulnerability": {
        "name": "CVE-2026-40977"
      },
      "action_statement": "Vulnerability CVE-2026-40977 affects version 2.7.7-tuxcare.1 of org.springframework.boot:spring-boot-starter-mail."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.7.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.7.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T11:51:30.356687+00:00",
      "status_notes": "Vulnerability CVE-2026-40992 affects version 2.7.7-tuxcare.1 of org.springframework.boot:spring-boot-starter-mail.",
      "vulnerability": {
        "name": "CVE-2026-40992"
      },
      "action_statement": "Vulnerability CVE-2026-40992 affects version 2.7.7-tuxcare.1 of org.springframework.boot:spring-boot-starter-mail."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.7.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-mail@2.7.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T11:51:30.356687+00:00",
      "status_notes": "Vulnerability CVE-2026-41001 affects version 2.7.7-tuxcare.1 of org.springframework.boot:spring-boot-starter-mail.",
      "vulnerability": {
        "name": "CVE-2026-41001"
      },
      "action_statement": "Vulnerability CVE-2026-41001 affects version 2.7.7-tuxcare.1 of org.springframework.boot:spring-boot-starter-mail."
    }
  ]
}