{
  "@id": "urn:uuid:a9a406a8-9c1c-4ce3-af24-a7d7faced22c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:07:59.808671+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2016-2173 does not affect version 3.2.11-tuxcare.3 of org.springframework.amqp:spring-amqp. CVE-2016-2173 affects Spring AMQP before 1.5.5 via unsafe deserialization. Target version 3.2.11-tuxcare.3 contains the upstream fix (AllowedListDeserializingMessageConverter with checkAllowedList validation) introduced in version 1.5.5 by the Spring team. The fix was already present in the upstream release when TuxCare onboarded it. The vulnerable pattern (unrestricted DefaultDeserializer usage) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-2173"
      },
      "impact_statement": "CVE-2016-2173 affects Spring AMQP before 1.5.5 via unsafe deserialization. Target version 3.2.11-tuxcare.3 contains the upstream fix (AllowedListDeserializingMessageConverter with checkAllowedList validation) introduced in version 1.5.5 by the Spring team. The fix was already present in the upstream release when TuxCare onboarded it. The vulnerable pattern (unrestricted DefaultDeserializer usage) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.5), Snyk (< 1.5.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2017-8045 does not affect version 3.2.11-tuxcare.3 of org.springframework.amqp:spring-amqp. CVE-2017-8045 concerns unsafe deserialization in Spring AMQP's Message.toString() method that could lead to remote code execution. The target repository (Spring AMQP version 3.2.11-tuxcare.3) is NOT AFFECTED because the vulnerable code pattern is not present. The upstream vendor applied a fix in commit ed824637c (September 2021) that completely removed deserialization from the toString() method, replacing it with a safe string literal \"[serialized object]\". This fix was already present in the upstream release 3.2.11 that TuxCare onboarded, before any TuxCare modifications were applied. The current code at Message.java lines 120-122 shows this defense in place.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8045"
      },
      "impact_statement": "CVE-2017-8045 concerns unsafe deserialization in Spring AMQP's Message.toString() method that could lead to remote code execution. The target repository (Spring AMQP version 3.2.11-tuxcare.3) is NOT AFFECTED because the vulnerable code pattern is not present. The upstream vendor applied a fix in commit ed824637c (September 2021) that completely removed deserialization from the toString() method, replacing it with a safe string literal \"[serialized object]\". This fix was already present in the upstream release 3.2.11 that TuxCare onboarded, before any TuxCare modifications were applied. The current code at Message.java lines 120-122 shows this defense in place.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.5.7; >= 1.6.0, < 1.6.11; >= 1.7.0, < 1.7.4), cve.org (< 1.7.4; = 1.6.11; = 1.5.7), Snyk (>= 1.5.6.RELEASE, < 1.5.7.RELEASE; >= 1.6.10.RELEASE, < 1.6.11.RELEASE; >= 1.7.3.RELEASE, < 1.7.4.RELEASE; <= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T01:25:39.523350+00:00",
      "status_notes": "Vulnerability CVE-2018-11087 does not affect version 3.2.11-tuxcare.3 of org.springframework.amqp:spring-amqp. not_affected \u2014 CVE-2018-11087 affects Spring AMQP versions prior to 1.7.10 (1.x) and 2.0.6 (2.x) due to missing TLS hostname validation. Target version 3.2.11 has hostname verification enabled by default (RabbitConnectionFactoryBean.java line 160) and calls enableHostnameVerification() in both SSL setup paths. The fix (commit 444b74e95, AMQP-830) was already present in upstream release 3.2.11 when TuxCare onb...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11087"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-11087 affects Spring AMQP versions prior to 1.7.10 (1.x) and 2.0.6 (2.x) due to missing TLS hostname validation. Target version 3.2.11 has hostname verification enabled by default (RabbitConnectionFactoryBean.java line 160) and calls enableHostnameVerification() in both SSL setup paths. The fix (commit 444b74e95, AMQP-830) was already present in upstream release 3.2.11 when TuxCare onb..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T05:02:57.848250+00:00",
      "status_notes": "Vulnerability CVE-2021-22095 does not affect version 3.2.11-tuxcare.3 of org.springframework.amqp:spring-amqp. not_affected \u2014 Spring AMQP 3.2.11 is NOT affected by CVE-2021-22095. The vulnerability (unconditional String creation from message body in toString() causing OOM with large messages) was fixed upstream before this version was released. The fix (maxBodyLength check with default 50-byte limit) is present at Message.java:124, introduced by upstream commit 4f3a1539d (author: grussell@vmware.com) which was already...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22095"
      },
      "impact_statement": "not_affected \u2014 Spring AMQP 3.2.11 is NOT affected by CVE-2021-22095. The vulnerability (unconditional String creation from message body in toString() causing OOM with large messages) was fixed upstream before this version was released. The fix (maxBodyLength check with default 50-byte limit) is present at Message.java:124, introduced by upstream commit 4f3a1539d (author: grussell@vmware.com) which was already..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T05:05:49.781758+00:00",
      "status_notes": "Vulnerability CVE-2021-22097 does not affect version 3.2.11-tuxcare.3 of org.springframework.amqp:spring-amqp. not_affected \u2014 Target Spring AMQP 3.2.11 is not affected by CVE-2021-22097. The vulnerability, which allowed CPU exhaustion through malicious java.util.Dictionary objects deserialized in Message.toString(), was fixed in upstream Spring AMQP before version 3.2.11 was released. The fix commit ed824637c (Gary Russell, Sept 27 2021) removed the dangerous deserialization call and replaced it with a safe static str...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22097"
      },
      "impact_statement": "not_affected \u2014 Target Spring AMQP 3.2.11 is not affected by CVE-2021-22097. The vulnerability, which allowed CPU exhaustion through malicious java.util.Dictionary objects deserialized in Message.toString(), was fixed in upstream Spring AMQP before version 3.2.11 was released. The fix commit ed824637c (Gary Russell, Sept 27 2021) removed the dangerous deserialization call and replaced it with a safe static str..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-23T11:01:49.503620+00:00",
      "status_notes": "Vulnerability CVE-2026-41701 does not affect version 3.2.11-tuxcare.3 of org.springframework.amqp:spring-amqp. Spring Amqp 3.2.11 is not vulnerable as it is equal to upstream fix version - 3.2.11",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41701"
      },
      "impact_statement": "Spring Amqp 3.2.11 is not vulnerable as it is equal to upstream fix version - 3.2.11"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-23T11:01:49.503620+00:00",
      "status_notes": "Vulnerability CVE-2026-41714 does not affect version 3.2.11-tuxcare.3 of org.springframework.amqp:spring-amqp. Spring Amqp 3.2.11 is not vulnerable as it is equal to upstream fix version - 3.2.11",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41714"
      },
      "impact_statement": "Spring Amqp 3.2.11 is not vulnerable as it is equal to upstream fix version - 3.2.11"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-23T08:23:33.984637+00:00",
      "status_notes": "Vulnerability CVE-2026-47860 is fixed in version 3.2.11-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-47860"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.11-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.amqp/spring-amqp@3.2.11-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-23T08:23:33.984637+00:00",
      "status_notes": "Vulnerability CVE-2026-59275 is fixed in version 3.2.11-tuxcare.3 of org.springframework.amqp:spring-amqp.",
      "vulnerability": {
        "name": "CVE-2026-59275"
      }
    }
  ]
}