{
  "@id": "urn:uuid:f888b7f7-851a-49b2-a636-60e99caf6aa0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@4.5.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@4.5.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2022-22980 does not affect version 4.5.13-tuxcare.3 of org.springframework.data:spring-data-mongodb. The target repository Spring Data MongoDB version 4.5.13-tuxcare.3 is NOT AFFECTED by CVE-2022-22980 (SpEL Injection vulnerability). The upstream vendor fix for this vulnerability was already present in the Spring Data MongoDB 4.5.13 release that TuxCare onboarded. The fix commit (30a417d810c43dd097e117beb24ca49074c5b04d) authored by Christoph Strobl (cstrobl@vmware.com) is an ancestor of the TuxCare onboarding commit, meaning the vulnerable code pattern was never present in the TuxCare-maintained version. The fix implements proper parameter binding using SpEL variables instead of string substitution, preventing parameter values from being interpreted as executable SpEL code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.1; < 3.3.5), NVD (<= 3.3.4; = 3.4.0), cve.org (>= 3.3.0, <= 3.3.4; = 3.4.0), Snyk (< 3.3.5; >= 3.4.0, < 3.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22980"
      },
      "impact_statement": "The target repository Spring Data MongoDB version 4.5.13-tuxcare.3 is NOT AFFECTED by CVE-2022-22980 (SpEL Injection vulnerability). The upstream vendor fix for this vulnerability was already present in the Spring Data MongoDB 4.5.13 release that TuxCare onboarded. The fix commit (30a417d810c43dd097e117beb24ca49074c5b04d) authored by Christoph Strobl (cstrobl@vmware.com) is an ancestor of the TuxCare onboarding commit, meaning the vulnerable code pattern was never present in the TuxCare-maintained version. The fix implements proper parameter binding using SpEL variables instead of string substitution, preventing parameter values from being interpreted as executable SpEL code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.1; < 3.3.5), NVD (<= 3.3.4; = 3.4.0), cve.org (>= 3.3.0, <= 3.3.4; = 3.4.0), Snyk (< 3.3.5; >= 3.4.0, < 3.4.1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@4.5.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@4.5.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-22T15:28:38.629763+00:00",
      "status_notes": "Vulnerability CVE-2026-41696 does not affect version 4.5.13-tuxcare.3 of org.springframework.data:spring-data-mongodb. Fixes 21c22973 (gh-5095) and 24d5afc0 (gh-5204) ship in upstream 4.5.12; advisory lists affected as 4.5.0-4.5.11",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41696"
      },
      "impact_statement": "Fixes 21c22973 (gh-5095) and 24d5afc0 (gh-5204) ship in upstream 4.5.12; advisory lists affected as 4.5.0-4.5.11"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@4.5.13-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@4.5.13-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-22T15:28:38.629763+00:00",
      "status_notes": "Vulnerability CVE-2026-41717 does not affect version 4.5.13-tuxcare.3 of org.springframework.data:spring-data-mongodb. Fix 4488760c (gh-5205) ships in upstream 4.5.12; advisory lists affected as 4.5.0-4.5.11",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41717"
      },
      "impact_statement": "Fix 4488760c (gh-5205) ships in upstream 4.5.12; advisory lists affected as 4.5.0-4.5.11"
    }
  ]
}