{
  "@id": "urn:uuid:cc64a9ff-a662-4dbe-b6f4-e771cb82c7b2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 18,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:05:17.011429+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.5.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.5.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:05:17.011429+00:00",
      "status_notes": "Vulnerability CVE-2023-20883 does not affect version 3.5.16-tuxcare.4 of org.springframework.boot:spring-boot-autoconfigure. Spring Boot 3.5.16-tuxcare.8 is NOT affected by CVE-2023-20883. The vulnerability (DoS via reverse proxy cache exhaustion when non-HTML Accept headers trigger 404 responses on the root path) was fixed in upstream commit 418dd1ba5b by Phillip Webb. This fix adds WelcomePageNotAcceptableHandlerMapping, which returns HTTP 406 (Not Acceptable) instead of 404 when a welcome page exists but the client's Accept header doesn't request HTML. The fix was already present in the upstream Spring Boot 3.5.16 release that TuxCare onboarded on 2024-11-15, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.0.0, < 3.0.7; >= 2.7.0, < 2.7.12; >= 2.6.0, < 2.6.15; < 2.5.15), NVD (< 2.5.14; >= 2.6.0, <= 2.6.14; >= 2.7.0, <= 2.7.11; >= 3.0.0, <= 3.0.6), cve.org (>= 3.0.0, <= 3.0.6; >= 2.7.0, <= 2.7.11; >= 2.6.0, <= 2.6.14; >= 2.5.0, <= 2.5.14), Snyk (< 2.5.15; >= 2.6.0, < 2.6.15; >= 2.7.0, < 2.7.12; >= 3.0.0, < 3.0.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20883"
      },
      "impact_statement": "Spring Boot 3.5.16-tuxcare.8 is NOT affected by CVE-2023-20883. The vulnerability (DoS via reverse proxy cache exhaustion when non-HTML Accept headers trigger 404 responses on the root path) was fixed in upstream commit 418dd1ba5b by Phillip Webb. This fix adds WelcomePageNotAcceptableHandlerMapping, which returns HTTP 406 (Not Acceptable) instead of 404 when a welcome page exists but the client's Accept header doesn't request HTML. The fix was already present in the upstream Spring Boot 3.5.16 release that TuxCare onboarded on 2024-11-15, so the vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.0.0, < 3.0.7; >= 2.7.0, < 2.7.12; >= 2.6.0, < 2.6.15; < 2.5.15), NVD (< 2.5.14; >= 2.6.0, <= 2.6.14; >= 2.7.0, <= 2.7.11; >= 3.0.0, <= 3.0.6), cve.org (>= 3.0.0, <= 3.0.6; >= 2.7.0, <= 2.7.11; >= 2.6.0, <= 2.6.14; >= 2.5.0, <= 2.5.14), Snyk (< 2.5.15; >= 2.6.0, < 2.6.15; >= 2.7.0, < 2.7.12; >= 3.0.0, < 3.0.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.5.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.5.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T06:46:50.295018+00:00",
      "status_notes": "Vulnerability CVE-2026-40971 does not affect version 3.5.16-tuxcare.4 of org.springframework.boot:spring-boot-autoconfigure. not_affected \u2014 The target Spring Boot 3.5.16-tuxcare.8 is NOT AFFECTED by CVE-2026-40971. The upstream fix commit e4febe2015 (\"Apply verify-hostname consistently\") by Andy Wilkinson was already included in Spring Boot 3.5.16 when TuxCare onboarded the release. Both required code changes are present: (1) RabbitConnectionFactoryBeanConfigurer.java now applies the hostname verification setting for both SSL bundl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40971"
      },
      "impact_statement": "not_affected \u2014 The target Spring Boot 3.5.16-tuxcare.8 is NOT AFFECTED by CVE-2026-40971. The upstream fix commit e4febe2015 (\"Apply verify-hostname consistently\") by Andy Wilkinson was already included in Spring Boot 3.5.16 when TuxCare onboarded the release. Both required code changes are present: (1) RabbitConnectionFactoryBeanConfigurer.java now applies the hostname verification setting for both SSL bundl..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.5.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.5.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T06:36:33.357741+00:00",
      "status_notes": "Vulnerability CVE-2026-40974 does not affect version 3.5.16-tuxcare.4 of org.springframework.boot:spring-boot-autoconfigure. not_affected \u2014 The target Spring Boot 3.5.16-tuxcare.8 is not affected by CVE-2026-40974. The vulnerability concerns missing hostname verification when establishing SSL connections to Cassandra. The fix, which adds a `verifyHostname` property (defaulting to `true`) and passes it to `ProgrammaticSslEngineFactory`, was already present in the upstream Spring Boot 3.5.16 release that TuxCare onboarded. The fix wa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40974"
      },
      "impact_statement": "not_affected \u2014 The target Spring Boot 3.5.16-tuxcare.8 is not affected by CVE-2026-40974. The vulnerability concerns missing hostname verification when establishing SSL connections to Cassandra. The fix, which adds a `verifyHostname` property (defaulting to `true`) and passes it to `ProgrammaticSslEngineFactory`, was already present in the upstream Spring Boot 3.5.16 release that TuxCare onboarded. The fix wa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.5.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.5.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40992 does not affect version 3.5.16-tuxcare.4 of org.springframework.boot:spring-boot-autoconfigure. 3.5.16 is not vulnerable, as it is outside the affected range (>= 3.5.0, <= 3.5.14; fixed in 3.5.15). The upstream fix commit 327bef3a71561a6844ede3039a4d4e7bf38016cf ('Enable hostname verification by default in Mail auto-config') is present in the history of tuxcare-current/3.5.16: MailProperties.Ssl.verifyHostname defaults to true and MailSenderPropertiesConfiguration sets mail.<protocol>.ssl.checkserveridentity=true. Nothing to backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40992"
      },
      "impact_statement": "3.5.16 is not vulnerable, as it is outside the affected range (>= 3.5.0, <= 3.5.14; fixed in 3.5.15). The upstream fix commit 327bef3a71561a6844ede3039a4d4e7bf38016cf ('Enable hostname verification by default in Mail auto-config') is present in the history of tuxcare-current/3.5.16: MailProperties.Ssl.verifyHostname defaults to true and MailSenderPropertiesConfiguration sets mail.<protocol>.ssl.checkserveridentity=true. Nothing to backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.5.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.5.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41001 does not affect version 3.5.16-tuxcare.4 of org.springframework.boot:spring-boot-autoconfigure. 3.5.16 is not vulnerable, as it is outside the affected range (>= 3.5.0, <= 3.5.14; fixed in 3.5.15). The upstream fix commit 4218bd76e934e5cf9e3fd3997c67b8a6b0d0c111 ('Fix predictable temp directory in Artemis embedded configuration') is present in the history of tuxcare-current/3.5.16, and ArtemisEmbeddedConfigurationFactory.getDataDir() returns new ApplicationTemp().getDir('artemis-data') rather than the vulnerable java.io.tmpdir path. Nothing to backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41001"
      },
      "impact_statement": "3.5.16 is not vulnerable, as it is outside the affected range (>= 3.5.0, <= 3.5.14; fixed in 3.5.15). The upstream fix commit 4218bd76e934e5cf9e3fd3997c67b8a6b0d0c111 ('Fix predictable temp directory in Artemis embedded configuration') is present in the history of tuxcare-current/3.5.16, and ArtemisEmbeddedConfigurationFactory.getDataDir() returns new ApplicationTemp().getDir('artemis-data') rather than the vulnerable java.io.tmpdir path. Nothing to backport."
    }
  ]
}