{
  "@id": "urn:uuid:05b16dee-ddb1-410b-88a7-b9c10304047e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T17:02:00.147078+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-function-adapter-gcp@4.3.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-function-adapter-gcp@4.3.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T17:02:00.147078+00:00",
      "status_notes": "Vulnerability CVE-2022-22963 affects version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-function-adapter-gcp.",
      "vulnerability": {
        "name": "CVE-2022-22963"
      },
      "action_statement": "Vulnerability CVE-2022-22963 affects version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-function-adapter-gcp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-function-adapter-gcp@4.3.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-function-adapter-gcp@4.3.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T16:58:00.083970+00:00",
      "status_notes": "Vulnerability CVE-2026-40989 does not affect version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-function-adapter-gcp. not_affected \u2014 The target spring-cloud-function version 4.3.4 is not affected by CVE-2026-40989. The upstream vendor (VMware) fixed both the unbounded cache and recursive composition vulnerabilities in commit 6bcd55803c5a2ce0adec794fee1e03c2fac36cf9, which was already present in the 4.3.4 release that TuxCare onboarded. The vulnerable code patterns are not present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40989"
      },
      "impact_statement": "not_affected \u2014 The target spring-cloud-function version 4.3.4 is not affected by CVE-2026-40989. The upstream vendor (VMware) fixed both the unbounded cache and recursive composition vulnerabilities in commit 6bcd55803c5a2ce0adec794fee1e03c2fac36cf9, which was already present in the 4.3.4 release that TuxCare onboarded. The vulnerable code patterns are not present in the target."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-function-adapter-gcp@4.3.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-function-adapter-gcp@4.3.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T16:58:00.083970+00:00",
      "status_notes": "Vulnerability CVE-2026-40990 does not affect version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-function-adapter-gcp. not_affected \u2014 The target (spring-cloud-function 4.3.4-tuxcare.1) is not affected by CVE-2026-40990. The vulnerability (unbounded cache in FunctionRegistry causing OOM + recursive self-composition) was fixed by upstream commit 6bcd5580 authored by Oleg Zhurakousky (ozhurakousky@vmware.com). This fix was included in the upstream release 4.3.4 that TuxCare onboarded at commit 5eb6737f. Both defenses are present...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40990"
      },
      "impact_statement": "not_affected \u2014 The target (spring-cloud-function 4.3.4-tuxcare.1) is not affected by CVE-2026-40990. The vulnerability (unbounded cache in FunctionRegistry causing OOM + recursive self-composition) was fixed by upstream commit 6bcd5580 authored by Oleg Zhurakousky (ozhurakousky@vmware.com). This fix was included in the upstream release 4.3.4 that TuxCare onboarded at commit 5eb6737f. Both defenses are present..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-function-adapter-gcp@4.3.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-function-adapter-gcp@4.3.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T16:55:27.915717+00:00",
      "status_notes": "Vulnerability CVE-2026-59291 is fixed in version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-function-adapter-gcp.",
      "vulnerability": {
        "name": "CVE-2026-59291"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-function-adapter-gcp@4.3.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-function-adapter-gcp@4.3.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T16:55:27.915717+00:00",
      "status_notes": "Vulnerability CVE-2026-59299 is fixed in version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-function-adapter-gcp.",
      "vulnerability": {
        "name": "CVE-2026-59299"
      }
    }
  ]
}