{
  "@id": "urn:uuid:53544060-b3c1-4d86-81fe-5f220d3f5f2d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T13:29:32.974587+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@2.7.18.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@2.7.18.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-30T12:48:12.312716+00:00",
      "status_notes": "Vulnerability CVE-2018-1259 does not affect version 2.7.18.tuxcare of org.springframework.data:spring-data-commons. Spring Data Commons 2.7.18 already contains the fix for CVE-2018-1259: XmlBeamHttpMessageConverter disables DOCTYPE declarations and external entities by default, and the build uses XMLBeam 1.4.24 (fixed upstream in 1.13.12 and 2.0.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1259"
      },
      "impact_statement": "Spring Data Commons 2.7.18 already contains the fix for CVE-2018-1259: XmlBeamHttpMessageConverter disables DOCTYPE declarations and external entities by default, and the build uses XMLBeam 1.4.24 (fixed upstream in 1.13.12 and 2.0.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@2.7.18.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@2.7.18.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-30T13:13:00.092013+00:00",
      "status_notes": "Vulnerability CVE-2018-1273 does not affect version 2.7.18.tuxcare of org.springframework.data:spring-data-commons. Spring Data Commons 2.7.18 already contains the fix for CVE-2018-1273: MapDataBinder evaluates property paths with a restricted SimpleEvaluationContext instead of StandardEvaluationContext, so request parameters cannot run arbitrary SpEL (fixed upstream in 1.13.11 and 2.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1273"
      },
      "impact_statement": "Spring Data Commons 2.7.18 already contains the fix for CVE-2018-1273: MapDataBinder evaluates property paths with a restricted SimpleEvaluationContext instead of StandardEvaluationContext, so request parameters cannot run arbitrary SpEL (fixed upstream in 1.13.11 and 2.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@2.7.18.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@2.7.18.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-30T13:29:32.974587+00:00",
      "status_notes": "Vulnerability CVE-2018-1274 does not affect version 2.7.18.tuxcare of org.springframework.data:spring-data-commons. Spring Data Commons 2.7.18 already contains the fix for CVE-2018-1274: PropertyPath parsing fails with an error once a path exceeds 1000 segments, so crafted property paths cannot exhaust CPU or memory (fixed upstream in 1.13.11 and 2.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1274"
      },
      "impact_statement": "Spring Data Commons 2.7.18 already contains the fix for CVE-2018-1274: PropertyPath parsing fails with an error once a path exceeds 1000 segments, so crafted property paths cannot exhaust CPU or memory (fixed upstream in 1.13.11 and 2.0.6)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@2.7.18.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@2.7.18.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-14T10:32:31.099418+00:00",
      "status_notes": "Vulnerability CVE-2026-41695 affects version 2.7.18.tuxcare of org.springframework.data:spring-data-commons, and is fixed in 2.7.18-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-41695"
      },
      "action_statement": "Vulnerability CVE-2026-41695 affects version 2.7.18.tuxcare of org.springframework.data:spring-data-commons, and is fixed in 2.7.18-tuxcare.10."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@2.7.18.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@2.7.18.tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41711 affects version 2.7.18.tuxcare of org.springframework.data:spring-data-commons, and is fixed in 2.7.18-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-41711"
      },
      "action_statement": "Vulnerability CVE-2026-41711 affects version 2.7.18.tuxcare of org.springframework.data:spring-data-commons, and is fixed in 2.7.18-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@2.7.18.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@2.7.18.tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41716 affects version 2.7.18.tuxcare of org.springframework.data:spring-data-commons, and is fixed in 2.7.18-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-41716"
      },
      "action_statement": "Vulnerability CVE-2026-41716 affects version 2.7.18.tuxcare of org.springframework.data:spring-data-commons, and is fixed in 2.7.18-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@2.7.18.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@2.7.18.tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41721 affects version 2.7.18.tuxcare of org.springframework.data:spring-data-commons, and is fixed in 2.7.18-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-41721"
      },
      "action_statement": "Vulnerability CVE-2026-41721 affects version 2.7.18.tuxcare of org.springframework.data:spring-data-commons, and is fixed in 2.7.18-tuxcare.3."
    }
  ]
}