{
  "@id": "urn:uuid:00a76ce5-4063-4f17-9511-d76f22085aa4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T11:44:11.130637+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@2.1.5.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@2.1.5.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:44:11.130637+00:00",
      "status_notes": "Vulnerability CVE-2022-22980 does not affect version 2.1.5.RELEASE-tuxcare.1 of org.springframework.data:spring-data-mongodb. Spring Data MongoDB version 2.1.5.RELEASE is not affected by CVE-2022-22980. The vulnerable code (ParameterBindingJsonReader performing string substitution of parameter placeholders inside SpEL expressions) was introduced in version 2.2.0 and does not exist in version 2.1.5. Version 2.1.5 uses a different architecture (ExpressionEvaluatingParameterBinder) that evaluates SpEL expressions without vulnerable string substitution, treating parameter values as data in the EvaluationContext rather than concatenating them into expression strings before parsing.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22980"
      },
      "impact_statement": "Spring Data MongoDB version 2.1.5.RELEASE is not affected by CVE-2022-22980. The vulnerable code (ParameterBindingJsonReader performing string substitution of parameter placeholders inside SpEL expressions) was introduced in version 2.2.0 and does not exist in version 2.1.5. Version 2.1.5 uses a different architecture (ExpressionEvaluatingParameterBinder) that evaluates SpEL expressions without vulnerable string substitution, treating parameter values as data in the EvaluationContext rather than concatenating them into expression strings before parsing."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@2.1.5.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@2.1.5.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:44:11.130637+00:00",
      "status_notes": "Vulnerability CVE-2026-41696 does not affect version 2.1.5.RELEASE-tuxcare.1 of org.springframework.data:spring-data-mongodb. not_affected \u2014 Version 2.1.5.RELEASE is not affected by CVE-2026-41696. The vulnerable component (ParameterBindingJsonReader in org.springframework.data.mongodb.util.json package) does not exist in this version. The CVE describes a vulnerability in parameter binding for @Query annotations using /pattern/ regex literal syntax with \\Q...\\E quoting, but version 2.1.5 uses a different architecture (StringBasedMon...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41696"
      },
      "impact_statement": "not_affected \u2014 Version 2.1.5.RELEASE is not affected by CVE-2026-41696. The vulnerable component (ParameterBindingJsonReader in org.springframework.data.mongodb.util.json package) does not exist in this version. The CVE describes a vulnerability in parameter binding for @Query annotations using /pattern/ regex literal syntax with \\Q...\\E quoting, but version 2.1.5 uses a different architecture (StringBasedMon..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@2.1.5.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@2.1.5.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:44:11.130637+00:00",
      "status_notes": "Vulnerability CVE-2026-41717 does not affect version 2.1.5.RELEASE-tuxcare.1 of org.springframework.data:spring-data-mongodb. Spring Data MongoDB version 2.1.5.RELEASE is not affected by CVE-2026-41717. The vulnerable code (ParameterBindingJsonReader and ParameterBindingDocumentCodec classes with unsafe replaceAll() and recursive decode() patterns) was introduced in version 2.2 and does not exist in version 2.1.5.RELEASE. This version uses the older ExpressionEvaluatingParameterBinder architecture which already implements the safe parameter handling pattern (Matcher.quoteReplacement()) that upstream patches apply as the fix. TuxCare has backported this CVE to versions 3.x and 4.x but not to any 2.1.x versions, confirming this assessment.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41717"
      },
      "impact_statement": "Spring Data MongoDB version 2.1.5.RELEASE is not affected by CVE-2026-41717. The vulnerable code (ParameterBindingJsonReader and ParameterBindingDocumentCodec classes with unsafe replaceAll() and recursive decode() patterns) was introduced in version 2.2 and does not exist in version 2.1.5.RELEASE. This version uses the older ExpressionEvaluatingParameterBinder architecture which already implements the safe parameter handling pattern (Matcher.quoteReplacement()) that upstream patches apply as the fix. TuxCare has backported this CVE to versions 3.x and 4.x but not to any 2.1.x versions, confirming this assessment."
    }
  ]
}