{
  "@id": "urn:uuid:8d1a5c67-b728-495d-98d2-66b9dcd8dc5d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@3.3.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@3.3.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2022-22980 does not affect version 3.3.10-tuxcare.1 of org.springframework.data:spring-data-mongodb. The target repository (spring-data-mongodb 3.3.10-tuxcare.3) is NOT AFFECTED by CVE-2022-22980. The vulnerability pattern is not present because the upstream Spring Data MongoDB 3.3.10 release (tagged 2022-11-18) already contained the security fix that prevents SpEL injection. The fix was committed to the 3.3 maintenance branch on 2022-06-20 by upstream author Christoph Strobl (cstrobl@vmware.com) in commit 7c5ac764b, which introduced parameter type preservation to prevent attacker-controlled strings from being executed as SpEL code. When TuxCare onboarded version 3.3.10, this fix was already present in the upstream release. The target code at HEAD uses the fixed implementation with SPEL_PARAMETER_BINDING_PATTERN, __QVar variable substitution, and type-preserving parameter binding that blocks the injection attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.1; < 3.3.5), NVD (<= 3.3.4; = 3.4.0), cve.org (>= 3.3.0, <= 3.3.4; = 3.4.0), Snyk (< 3.3.5; >= 3.4.0, < 3.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22980"
      },
      "impact_statement": "The target repository (spring-data-mongodb 3.3.10-tuxcare.3) is NOT AFFECTED by CVE-2022-22980. The vulnerability pattern is not present because the upstream Spring Data MongoDB 3.3.10 release (tagged 2022-11-18) already contained the security fix that prevents SpEL injection. The fix was committed to the 3.3 maintenance branch on 2022-06-20 by upstream author Christoph Strobl (cstrobl@vmware.com) in commit 7c5ac764b, which introduced parameter type preservation to prevent attacker-controlled strings from being executed as SpEL code. When TuxCare onboarded version 3.3.10, this fix was already present in the upstream release. The target code at HEAD uses the fixed implementation with SPEL_PARAMETER_BINDING_PATTERN, __QVar variable substitution, and type-preserving parameter binding that blocks the injection attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.1; < 3.3.5), NVD (<= 3.3.4; = 3.4.0), cve.org (>= 3.3.0, <= 3.3.4; = 3.4.0), Snyk (< 3.3.5; >= 3.4.0, < 3.4.1)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@3.3.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@3.3.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41696 affects version 3.3.10-tuxcare.1 of org.springframework.data:spring-data-mongodb.",
      "vulnerability": {
        "name": "CVE-2026-41696"
      },
      "action_statement": "Vulnerability CVE-2026-41696 affects version 3.3.10-tuxcare.1 of org.springframework.data:spring-data-mongodb."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@3.3.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@3.3.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-21T12:32:35.760766+00:00",
      "status_notes": "Vulnerability CVE-2026-41717 affects version 3.3.10-tuxcare.1 of org.springframework.data:spring-data-mongodb, and is fixed in 3.3.10-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-41717"
      },
      "action_statement": "Vulnerability CVE-2026-41717 affects version 3.3.10-tuxcare.1 of org.springframework.data:spring-data-mongodb, and is fixed in 3.3.10-tuxcare.3."
    }
  ]
}