{
  "@id": "urn:uuid:78477269-665a-4a6f-9dae-b878466ecdc1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-28T14:28:00.155379+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-r2dbc@1.5.18-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-r2dbc@1.5.18-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-10-28T14:28:00.155379+00:00",
      "status_notes": "Vulnerability CVE-2026-41697 does not affect version 1.5.18-tuxcare.9 of org.springframework.data:spring-data-r2dbc. not_affected \u2014 spring-data-r2dbc 1.5.18 does not contain the vulnerable code. CVE-2026-41697 is in RelationalExampleMapper (QBE STARTING/ENDING/CONTAINING matchers built by plain string concatenation), which lives in the spring-data-relational 2.4.18 dependency. r2dbc only calls it from SimpleR2dbcRepository, and its own QueryMapper already applies the dialect LIKE escaper to ValueFunction values, so no change is needed here. The fix ships in spring-data-relational 2.4.18-tuxcare.6 (VPV 96660, MR !63), released 2026-10-28 and managed by spring-data-bom 2021.2.18-tuxcare.12. The Backporter also found nothing to change (no_commits_produced, not_applicable). This matches the not_affected verdicts for this CVE on r2dbc 1.4.4 (VPV 546821), 1.3.11 and 1.2.12.",
      "vulnerability": {
        "name": "CVE-2026-41697"
      },
      "impact_statement": "not_affected \u2014 spring-data-r2dbc 1.5.18 does not contain the vulnerable code. CVE-2026-41697 is in RelationalExampleMapper (QBE STARTING/ENDING/CONTAINING matchers built by plain string concatenation), which lives in the spring-data-relational 2.4.18 dependency. r2dbc only calls it from SimpleR2dbcRepository, and its own QueryMapper already applies the dialect LIKE escaper to ValueFunction values, so no change is needed here. The fix ships in spring-data-relational 2.4.18-tuxcare.6 (VPV 96660, MR !63), released 2026-10-28 and managed by spring-data-bom 2021.2.18-tuxcare.12. The Backporter also found nothing to change (no_commits_produced, not_applicable). This matches the not_affected verdicts for this CVE on r2dbc 1.4.4 (VPV 546821), 1.3.11 and 1.2.12."
    }
  ]
}