{
  "@id": "urn:uuid:13801dec-8f2f-479a-8a73-3713145ed26c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:02:00.202619+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@4.3.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@4.3.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability CVE-2022-22980 does not affect version 4.3.12-tuxcare.3 of org.springframework.data:spring-data-mongodb. The target repository (Spring Data MongoDB 4.3.12-tuxcare.3) is not affected by CVE-2022-22980. The security fix was already present in the upstream Spring Data MongoDB 4.3.12 release that TuxCare onboarded. The fix, authored by Christoph Strobl from VMware on June 14, 2022 (commit 30a417d81), prevents SpEL injection by binding query parameters as typed SpEL variables instead of converting them to strings and directly substituting them into SpEL expressions. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.1; < 3.3.5), NVD (<= 3.3.4; = 3.4.0), cve.org (>= 3.3.0, <= 3.3.4; = 3.4.0), Snyk (< 3.3.5; >= 3.4.0, < 3.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22980"
      },
      "impact_statement": "The target repository (Spring Data MongoDB 4.3.12-tuxcare.3) is not affected by CVE-2022-22980. The security fix was already present in the upstream Spring Data MongoDB 4.3.12 release that TuxCare onboarded. The fix, authored by Christoph Strobl from VMware on June 14, 2022 (commit 30a417d81), prevents SpEL injection by binding query parameters as typed SpEL variables instead of converting them to strings and directly substituting them into SpEL expressions. The vulnerable pattern is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.1; < 3.3.5), NVD (<= 3.3.4; = 3.4.0), cve.org (>= 3.3.0, <= 3.3.4; = 3.4.0), Snyk (< 3.3.5; >= 3.4.0, < 3.4.1)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@4.3.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@4.3.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-19T17:00:00.136699+00:00",
      "status_notes": "Vulnerability CVE-2026-41696 is fixed in version 4.3.12-tuxcare.3 of org.springframework.data:spring-data-mongodb.",
      "vulnerability": {
        "name": "CVE-2026-41696"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@4.3.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@4.3.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-19T17:00:00.136699+00:00",
      "status_notes": "Vulnerability CVE-2026-41717 is fixed in version 4.3.12-tuxcare.3 of org.springframework.data:spring-data-mongodb.",
      "vulnerability": {
        "name": "CVE-2026-41717"
      }
    }
  ]
}