{
  "@id": "urn:uuid:ae4cb1e4-e256-4532-abc5-f719e3e28404",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:04:11.456857+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@4.0.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@4.0.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2022-22980 does not affect version 4.0.12-tuxcare.2 of org.springframework.data:spring-data-mongodb. The target repository (spring-data-mongodb version 4.0.12) is NOT AFFECTED by CVE-2022-22980. The upstream vendor fix (commit 30a417d810c43dd097e117beb24ca49074c5b04d by Christoph Strobl from VMware/Spring) was already present in the Spring Data MongoDB 4.0.12 release that TuxCare onboarded. The fix eliminates the SpEL injection vulnerability by replacing direct string substitution of parameter values into SpEL expressions with a secure variable-binding mechanism. The vulnerable code pattern has been completely removed and all fix components are present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.1; < 3.3.5), NVD (<= 3.3.4; = 3.4.0), cve.org (>= 3.3.0, <= 3.3.4; = 3.4.0), Snyk (< 3.3.5; >= 3.4.0, < 3.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22980"
      },
      "impact_statement": "The target repository (spring-data-mongodb version 4.0.12) is NOT AFFECTED by CVE-2022-22980. The upstream vendor fix (commit 30a417d810c43dd097e117beb24ca49074c5b04d by Christoph Strobl from VMware/Spring) was already present in the Spring Data MongoDB 4.0.12 release that TuxCare onboarded. The fix eliminates the SpEL injection vulnerability by replacing direct string substitution of parameter values into SpEL expressions with a secure variable-binding mechanism. The vulnerable code pattern has been completely removed and all fix components are present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.1; < 3.3.5), NVD (<= 3.3.4; = 3.4.0), cve.org (>= 3.3.0, <= 3.3.4; = 3.4.0), Snyk (< 3.3.5; >= 3.4.0, < 3.4.1)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@4.0.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@4.0.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T11:36:29.516775+00:00",
      "status_notes": "Vulnerability CVE-2026-41696 affects version 4.0.12-tuxcare.2 of org.springframework.data:spring-data-mongodb.",
      "vulnerability": {
        "name": "CVE-2026-41696"
      },
      "action_statement": "Vulnerability CVE-2026-41696 affects version 4.0.12-tuxcare.2 of org.springframework.data:spring-data-mongodb."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@4.0.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@4.0.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T11:36:29.516775+00:00",
      "status_notes": "Vulnerability CVE-2026-41717 is fixed in version 4.0.12-tuxcare.2 of org.springframework.data:spring-data-mongodb.",
      "vulnerability": {
        "name": "CVE-2026-41717"
      }
    }
  ]
}