{
  "@id": "urn:uuid:d86e602d-1b7e-4be4-8d5b-a578e68859f4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:04:11.456857+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@4.5.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@4.5.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2022-22980 does not affect version 4.5.12-tuxcare.1 of org.springframework.data:spring-data-mongodb. The target repository spring-data-mongodb version 4.5.12-tuxcare.1 is NOT AFFECTED by CVE-2022-22980 (SpEL Injection vulnerability). The upstream Spring Data MongoDB project fixed this vulnerability in commit 30a417d810c43dd097e117beb24ca49074c5b04d authored by Christoph Strobl (cstrobl@vmware.com) on June 14, 2022. This fix was already included in the upstream 4.5.12 release that TuxCare onboarded. The fix prevents SpEL injection by passing query parameters as typed variables in the SpEL evaluation context instead of string-interpolating them into the expression, thereby preventing attacker-controlled parameter values from being interpreted as executable SpEL code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.1; < 3.3.5), NVD (<= 3.3.4; = 3.4.0), cve.org (>= 3.3.0, <= 3.3.4; = 3.4.0), Snyk (< 3.3.5; >= 3.4.0, < 3.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22980"
      },
      "impact_statement": "The target repository spring-data-mongodb version 4.5.12-tuxcare.1 is NOT AFFECTED by CVE-2022-22980 (SpEL Injection vulnerability). The upstream Spring Data MongoDB project fixed this vulnerability in commit 30a417d810c43dd097e117beb24ca49074c5b04d authored by Christoph Strobl (cstrobl@vmware.com) on June 14, 2022. This fix was already included in the upstream 4.5.12 release that TuxCare onboarded. The fix prevents SpEL injection by passing query parameters as typed variables in the SpEL evaluation context instead of string-interpolating them into the expression, thereby preventing attacker-controlled parameter values from being interpreted as executable SpEL code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.1; < 3.3.5), NVD (<= 3.3.4; = 3.4.0), cve.org (>= 3.3.0, <= 3.3.4; = 3.4.0), Snyk (< 3.3.5; >= 3.4.0, < 3.4.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@4.5.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@4.5.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-21T10:36:00.122180+00:00",
      "status_notes": "Vulnerability CVE-2026-41696 does not affect version 4.5.12-tuxcare.1 of org.springframework.data:spring-data-mongodb. CVE-2026-41696 is already fixed in spring-data-mongodb 4.5.12. The vulnerability involved insufficient escaping of user-supplied parameters in regex patterns using \\Q..\\E quoting, allowing attackers to inject arbitrary regex patterns. The fix (commit 24d5afc0c, authored by upstream vendor Christoph Strobl) properly escapes \\E sequences via the escapeIfQuoted() method",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41696"
      },
      "impact_statement": "CVE-2026-41696 is already fixed in spring-data-mongodb 4.5.12. The vulnerability involved insufficient escaping of user-supplied parameters in regex patterns using \\Q..\\E quoting, allowing attackers to inject arbitrary regex patterns. The fix (commit 24d5afc0c, authored by upstream vendor Christoph Strobl) properly escapes \\E sequences via the escapeIfQuoted() method"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@4.5.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@4.5.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T11:02:36.632099+00:00",
      "status_notes": "Vulnerability CVE-2026-41717 does not affect version 4.5.12-tuxcare.1 of org.springframework.data:spring-data-mongodb. Spring Data MongoDB 4.5.12 is not vulnerable as it is equal to upstream fix version - 4.5.12",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41717"
      },
      "impact_statement": "Spring Data MongoDB 4.5.12 is not vulnerable as it is equal to upstream fix version - 4.5.12"
    }
  ]
}