{
  "@id": "urn:uuid:33eabd71-b2a7-4b3c-81b9-a0f6a4c4b57e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator@2.7.18.tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator@2.7.18.tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-31T14:04:51.744136+00:00",
      "status_notes": "Vulnerability CVE-2023-34055 does not affect version 2.7.18.tuxcare.6 of org.springframework.boot:spring-boot-actuator. not_affected \u2014 CVE-2023-34055 does not affect this Spring Boot 2.7.18-tuxcare.23 build. The vulnerability pattern (accepting arbitrary HTTP method strings causing unbounded metrics tag creation) is not present. The fix validating HTTP methods against the HttpMethod enum and returning constant \"UNKNOWN\" for non-standard methods was already included in upstream Spring Boot v2.7.18, which this TuxCare build is b...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34055"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-34055 does not affect this Spring Boot 2.7.18-tuxcare.23 build. The vulnerability pattern (accepting arbitrary HTTP method strings causing unbounded metrics tag creation) is not present. The fix validating HTTP methods against the HttpMethod enum and returning constant \"UNKNOWN\" for non-standard methods was already included in upstream Spring Boot v2.7.18, which this TuxCare build is b..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator@2.7.18.tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator@2.7.18.tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-38286 affects version 2.7.18.tuxcare.6 of org.springframework.boot:spring-boot-actuator, and is fixed in 2.7.18-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2023-38286"
      },
      "action_statement": "Vulnerability CVE-2023-38286 affects version 2.7.18.tuxcare.6 of org.springframework.boot:spring-boot-actuator, and is fixed in 2.7.18-tuxcare.10."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator@2.7.18.tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator@2.7.18.tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-28T18:36:42.887038+00:00",
      "status_notes": "Vulnerability CVE-2026-22731 affects version 2.7.18.tuxcare.6 of org.springframework.boot:spring-boot-actuator.",
      "vulnerability": {
        "name": "CVE-2026-22731"
      },
      "action_statement": "Vulnerability CVE-2026-22731 affects version 2.7.18.tuxcare.6 of org.springframework.boot:spring-boot-actuator."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator@2.7.18.tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator@2.7.18.tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22733 affects version 2.7.18.tuxcare.6 of org.springframework.boot:spring-boot-actuator, and is fixed in 2.7.18-tuxcare.13.",
      "vulnerability": {
        "name": "CVE-2026-22733"
      },
      "action_statement": "Vulnerability CVE-2026-22733 affects version 2.7.18.tuxcare.6 of org.springframework.boot:spring-boot-actuator, and is fixed in 2.7.18-tuxcare.13."
    }
  ]
}