{
  "@id": "urn:uuid:847cee99-9703-4edc-b51d-a1a348078623",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:13:00.045658+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2018-1196 does not affect version 3.4.13-tuxcare.3 of org.springframework.boot:spring-boot. not_affected \u2014 The target Spring Boot 3.4.13 repository is NOT AFFECTED by CVE-2018-1196. The symlink attack vulnerability in the embedded launch script was fixed by upstream Spring Boot in January-February 2018 (commits 9b8cb9a463 and d59000ceb1 by Pivotal engineers). These fixes were already present in the upstream Spring Boot 3.4.13 release that TuxCare onboarded in July 2026. The launch.script at lines 17...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1196"
      },
      "impact_statement": "not_affected \u2014 The target Spring Boot 3.4.13 repository is NOT AFFECTED by CVE-2018-1196. The symlink attack vulnerability in the embedded launch script was fixed by upstream Spring Boot in January-February 2018 (commits 9b8cb9a463 and d59000ceb1 by Pivotal engineers). These fixes were already present in the upstream Spring Boot 3.4.13 release that TuxCare onboarded in July 2026. The launch.script at lines 17..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 does not affect version 3.4.13-tuxcare.3 of org.springframework.boot:spring-boot. CVE-2022-27772 (temporary directory hijacking via race condition) is NOT present in Spring Boot 3.4.13-tuxcare.3. The vulnerable pattern (File.createTempFile \u2192 delete \u2192 mkdir) was replaced with the secure Files.createTempDirectory() method by upstream commit 667ccdae84 (Andy Wilkinson, October 2020). This fix was already present in the upstream Spring Boot 3.4.13 release that TuxCare onboarded (commit 950dddb70a). All web server factories (Tomcat, Jetty, Undertow, Netty) inherit the secure createTempDir() method from AbstractConfigurableWebServerFactory. No vulnerable code paths exist in production code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "impact_statement": "CVE-2022-27772 (temporary directory hijacking via race condition) is NOT present in Spring Boot 3.4.13-tuxcare.3. The vulnerable pattern (File.createTempFile \u2192 delete \u2192 mkdir) was replaced with the secure Files.createTempDirectory() method by upstream commit 667ccdae84 (Andy Wilkinson, October 2020). This fix was already present in the upstream Spring Boot 3.4.13 release that TuxCare onboarded (commit 950dddb70a). All web server factories (Tomcat, Jetty, Undertow, Netty) inherit the secure createTempDir() method from AbstractConfigurableWebServerFactory. No vulnerable code paths exist in production code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-06T17:24:21.599166+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 does not affect version 3.4.13-tuxcare.3 of org.springframework.boot:spring-boot. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 3.4.5, and version 3.4.13 is a later release of the same line. Advisories: GitHub GHSA-rc42-6c7j-7h5r (fixed in 3.4.5), CVE record (fixed in 3.4.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22235"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 3.4.5, and version 3.4.13 is a later release of the same line. Advisories: GitHub GHSA-rc42-6c7j-7h5r (fixed in 3.4.5), CVE record (fixed in 3.4.5)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 is fixed in version 3.4.13-tuxcare.3 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 affects version 3.4.13-tuxcare.3 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40975"
      },
      "action_statement": "Vulnerability CVE-2026-40975 affects version 3.4.13-tuxcare.3 of org.springframework.boot:spring-boot."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-10T04:13:00.045658+00:00",
      "status_notes": "Vulnerability CVE-2026-40976 does not affect version 3.4.13-tuxcare.3 of org.springframework.boot:spring-boot. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its default servlet security chain always configures authorization, so the vulnerable omission cannot occur. In spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfiguration.java:65, the chain permits health requests and requires authentication for every other request.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-40976"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its default servlet security chain always configures authorization, so the vulnerable omission cannot occur. In spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfiguration.java:65, the chain permits health requests and requires authentication for every other request."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.4.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.4.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 is fixed in version 3.4.13-tuxcare.3 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40977"
      }
    }
  ]
}