{
  "@id": "urn:uuid:73676c99-9504-4471-bd52-ae804eadd6c4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:02:00.202619+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-function-context@4.3.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-function-context@4.3.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability CVE-2022-22963 does not affect version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-function-context. Spring Cloud Function 4.3.4-tuxcare.1 is NOT vulnerable to CVE-2022-22963. The fix for this SpEL injection vulnerability was already present in the upstream 4.3.4 release that TuxCare onboarded. The vulnerable pattern (using StandardEvaluationContext for header-provided routing expressions) has been replaced with SimpleEvaluationContext, which prevents type references and method invocations required for RCE. CVE-2022-22963 affects versions 3.1.6, 3.2.2 and older; version 4.3.4 is significantly newer and includes the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.2.0, < 3.2.3; < 3.1.7), NVD (<= 3.1.6; >= 3.2.0, <= 3.2.2), cve.org (= 3.1.6; = 3.2.2), Snyk (< 3.1.7; >= 3.2.0, < 3.2.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22963"
      },
      "impact_statement": "Spring Cloud Function 4.3.4-tuxcare.1 is NOT vulnerable to CVE-2022-22963. The fix for this SpEL injection vulnerability was already present in the upstream 4.3.4 release that TuxCare onboarded. The vulnerable pattern (using StandardEvaluationContext for header-provided routing expressions) has been replaced with SimpleEvaluationContext, which prevents type references and method invocations required for RCE. CVE-2022-22963 affects versions 3.1.6, 3.2.2 and older; version 4.3.4 is significantly newer and includes the upstream fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.2.0, < 3.2.3; < 3.1.7), NVD (<= 3.1.6; >= 3.2.0, <= 3.2.2), cve.org (= 3.1.6; = 3.2.2), Snyk (< 3.1.7; >= 3.2.0, < 3.2.3)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-function-context@4.3.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-function-context@4.3.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:00:16.985656+00:00",
      "status_notes": "Vulnerability CVE-2026-40989 does not affect version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-function-context. not_affected \u2014 The target spring-cloud-function version 4.3.4 is not affected by CVE-2026-40989. The upstream vendor (VMware) fixed both the unbounded cache and recursive composition vulnerabilities in commit 6bcd55803c5a2ce0adec794fee1e03c2fac36cf9, which was already present in the 4.3.4 release that TuxCare onboarded. The vulnerable code patterns are not present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40989"
      },
      "impact_statement": "not_affected \u2014 The target spring-cloud-function version 4.3.4 is not affected by CVE-2026-40989. The upstream vendor (VMware) fixed both the unbounded cache and recursive composition vulnerabilities in commit 6bcd55803c5a2ce0adec794fee1e03c2fac36cf9, which was already present in the 4.3.4 release that TuxCare onboarded. The vulnerable code patterns are not present in the target."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-function-context@4.3.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-function-context@4.3.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:00:16.985656+00:00",
      "status_notes": "Vulnerability CVE-2026-40990 does not affect version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-function-context. not_affected \u2014 The target (spring-cloud-function 4.3.4-tuxcare.1) is not affected by CVE-2026-40990. The vulnerability (unbounded cache in FunctionRegistry causing OOM + recursive self-composition) was fixed by upstream commit 6bcd5580 authored by Oleg Zhurakousky (ozhurakousky@vmware.com). This fix was included in the upstream release 4.3.4 that TuxCare onboarded at commit 5eb6737f. Both defenses are present...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40990"
      },
      "impact_statement": "not_affected \u2014 The target (spring-cloud-function 4.3.4-tuxcare.1) is not affected by CVE-2026-40990. The vulnerability (unbounded cache in FunctionRegistry causing OOM + recursive self-composition) was fixed by upstream commit 6bcd5580 authored by Oleg Zhurakousky (ozhurakousky@vmware.com). This fix was included in the upstream release 4.3.4 that TuxCare onboarded at commit 5eb6737f. Both defenses are present..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-function-context@4.3.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-function-context@4.3.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T16:55:27.915717+00:00",
      "status_notes": "Vulnerability CVE-2026-59291 is fixed in version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-function-context.",
      "vulnerability": {
        "name": "CVE-2026-59291"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-function-context@4.3.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-function-context@4.3.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T16:55:27.915717+00:00",
      "status_notes": "Vulnerability CVE-2026-59299 is fixed in version 4.3.4-tuxcare.1 of org.springframework.cloud:spring-cloud-function-context.",
      "vulnerability": {
        "name": "CVE-2026-59299"
      }
    }
  ]
}