{
  "@id": "urn:uuid:413d9e53-2ae0-4719-b6c0-aaec91a89f30",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:01:00.133094+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@3.4.18-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@3.4.18-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-04T09:01:00.133094+00:00",
      "status_notes": "Vulnerability CVE-2022-22980 does not affect version 3.4.18-tuxcare.8 of org.springframework.data:spring-data-mongodb. CVE-2022-22980 is not present in spring-data-mongodb 3.4.18-tuxcare.10. The vulnerability involved SpEL injection through unsafe string concatenation of query parameters into SpEL expressions. The upstream fix (commit 5e241c6ea55939c9587fad5058a07d7b3f0ccbd3 by cstrobl@vmware.com) replaced string concatenation with typed SpEL variable binding, preventing code injection. This fix was already present in upstream version 3.4.1 and all subsequent releases including 3.4.18, which TuxCare onboarded. The target contains the complete fix: ParameterBindingJsonReader.java uses SPEL_PARAMETER_BINDING_PATTERN and __QVar variables to pass parameters safely through the evaluation context.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.1; < 3.3.5), NVD (<= 3.3.4; = 3.4.0), cve.org (>= 3.3.0, <= 3.3.4; = 3.4.0), Snyk (< 3.3.5; >= 3.4.0, < 3.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22980"
      },
      "impact_statement": "CVE-2022-22980 is not present in spring-data-mongodb 3.4.18-tuxcare.10. The vulnerability involved SpEL injection through unsafe string concatenation of query parameters into SpEL expressions. The upstream fix (commit 5e241c6ea55939c9587fad5058a07d7b3f0ccbd3 by cstrobl@vmware.com) replaced string concatenation with typed SpEL variable binding, preventing code injection. This fix was already present in upstream version 3.4.1 and all subsequent releases including 3.4.18, which TuxCare onboarded. The target contains the complete fix: ParameterBindingJsonReader.java uses SPEL_PARAMETER_BINDING_PATTERN and __QVar variables to pass parameters safely through the evaluation context.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.1; < 3.3.5), NVD (<= 3.3.4; = 3.4.0), cve.org (>= 3.3.0, <= 3.3.4; = 3.4.0), Snyk (< 3.3.5; >= 3.4.0, < 3.4.1)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@3.4.18-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@3.4.18-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41696 affects version 3.4.18-tuxcare.8 of org.springframework.data:spring-data-mongodb.",
      "vulnerability": {
        "name": "CVE-2026-41696"
      },
      "action_statement": "Vulnerability CVE-2026-41696 affects version 3.4.18-tuxcare.8 of org.springframework.data:spring-data-mongodb."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@3.4.18-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@3.4.18-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41717 affects version 3.4.18-tuxcare.8 of org.springframework.data:spring-data-mongodb, and is fixed in 3.4.18-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-41717"
      },
      "action_statement": "Vulnerability CVE-2026-41717 affects version 3.4.18-tuxcare.8 of org.springframework.data:spring-data-mongodb, and is fixed in 3.4.18-tuxcare.9."
    }
  ]
}