{
  "@id": "urn:uuid:7ea64379-4b20-47d1-8899-4e3204e3db49",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:02:00.202619+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-function-parent@4.2.4-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-function-parent@4.2.4-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability CVE-2022-22979 does not affect version 4.2.4-tuxcare.1 of org.springframework.cloud:spring-cloud-function-parent. The target repository (spring-cloud-function 4.2.4-tuxcare.1) is NOT vulnerable to CVE-2022-22979. The concurrency fix preventing unbounded cache growth due to duplicate function registrations was already present in the upstream 4.2.4 release. The fix was introduced by Oleg Zhurakousky (VMware/Broadcom) in commit 085ae9f6 on May 30, 2022, which shipped with the upstream release that TuxCare later onboarded. The synchronized block in BeanFactoryAwareFunctionRegistry.lookup() prevents the race condition where concurrent lookups could register the same function multiple times, causing memory exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.6), NVD (< 3.2.6), cve.org (< 3.2.6), Snyk (< 3.2.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22979"
      },
      "impact_statement": "The target repository (spring-cloud-function 4.2.4-tuxcare.1) is NOT vulnerable to CVE-2022-22979. The concurrency fix preventing unbounded cache growth due to duplicate function registrations was already present in the upstream 4.2.4 release. The fix was introduced by Oleg Zhurakousky (VMware/Broadcom) in commit 085ae9f6 on May 30, 2022, which shipped with the upstream release that TuxCare later onboarded. The synchronized block in BeanFactoryAwareFunctionRegistry.lookup() prevents the race condition where concurrent lookups could register the same function multiple times, causing memory exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.6), NVD (< 3.2.6), cve.org (< 3.2.6), Snyk (< 3.2.6)."
    }
  ]
}