{
  "@id": "urn:uuid:86a99dbd-5a59-458d-8bc6-bdc9a74f2afd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@4.3.13-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@4.3.13-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2022-22980 does not affect version 4.3.13-tuxcare.1 of org.springframework.data:spring-data-mongodb. CVE-2022-22980 SpEL injection vulnerability is NOT present in spring-data-mongodb 4.3.13-tuxcare.8. The upstream vendor (VMware/Broadcom) fixed this vulnerability in June 2022 (commit 30a417d810), and the fix was already included in upstream release 4.3.13 when TuxCare onboarded it in 2025. The target code uses typed SpEL variables instead of string concatenation for parameter binding, preventing injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.1; < 3.3.5), NVD (<= 3.3.4; = 3.4.0), cve.org (>= 3.3.0, <= 3.3.4; = 3.4.0), Snyk (< 3.3.5; >= 3.4.0, < 3.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22980"
      },
      "impact_statement": "CVE-2022-22980 SpEL injection vulnerability is NOT present in spring-data-mongodb 4.3.13-tuxcare.8. The upstream vendor (VMware/Broadcom) fixed this vulnerability in June 2022 (commit 30a417d810), and the fix was already included in upstream release 4.3.13 when TuxCare onboarded it in 2025. The target code uses typed SpEL variables instead of string concatenation for parameter binding, preventing injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.1; < 3.3.5), NVD (<= 3.3.4; = 3.4.0), cve.org (>= 3.3.0, <= 3.3.4; = 3.4.0), Snyk (< 3.3.5; >= 3.4.0, < 3.4.1)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@4.3.13-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@4.3.13-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-06T12:35:00.225023+00:00",
      "status_notes": "Vulnerability CVE-2026-41696 affects version 4.3.13-tuxcare.1 of org.springframework.data:spring-data-mongodb, and is fixed in 4.3.13-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-41696"
      },
      "action_statement": "Vulnerability CVE-2026-41696 affects version 4.3.13-tuxcare.1 of org.springframework.data:spring-data-mongodb, and is fixed in 4.3.13-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@4.3.13-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@4.3.13-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41717 affects version 4.3.13-tuxcare.1 of org.springframework.data:spring-data-mongodb, and is fixed in 4.3.13-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-41717"
      },
      "action_statement": "Vulnerability CVE-2026-41717 affects version 4.3.13-tuxcare.1 of org.springframework.data:spring-data-mongodb, and is fixed in 4.3.13-tuxcare.5."
    }
  ]
}