{ "@id": "urn:uuid:1129fc44-cc73-4a32-8c17-407be01bb051", "role": "Document Creator", "author": "https://tuxcare.com", "version": 2, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T14:48:00.048187+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@2.6.23.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@2.6.23.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-06T14:46:40.810546+00:00", "status_notes": "Vulnerability CVE-2017-8046 affects version 2.6.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-rest-core.", "vulnerability": { "name": "CVE-2017-8046" }, "action_statement": "Vulnerability CVE-2017-8046 affects version 2.6.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-rest-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@2.6.23.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@2.6.23.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-06T14:46:40.810546+00:00", "status_notes": "Vulnerability CVE-2021-22047 affects version 2.6.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-rest-core.", "vulnerability": { "name": "CVE-2021-22047" }, "action_statement": "Vulnerability CVE-2021-22047 affects version 2.6.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-rest-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@2.6.23.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@2.6.23.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-06T14:46:40.810546+00:00", "status_notes": "Vulnerability CVE-2022-31679 affects version 2.6.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-rest-core.", "vulnerability": { "name": "CVE-2022-31679" }, "action_statement": "Vulnerability CVE-2022-31679 affects version 2.6.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-rest-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@2.6.23.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@2.6.23.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-06T14:46:40.810546+00:00", "status_notes": "Vulnerability CVE-2026-41728 affects version 2.6.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-rest-core.", "vulnerability": { "name": "CVE-2026-41728" }, "action_statement": "Vulnerability CVE-2026-41728 affects version 2.6.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-rest-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@2.6.23.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@2.6.23.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-06T14:46:40.810546+00:00", "status_notes": "Vulnerability CVE-2026-41729 does not affect version 2.6.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-rest-core. Version 2.6.23.RELEASE is not affected by CVE-2026-41729. The vulnerable code pattern (JsonPointerMapping class and Map-specific SpEL generation) was introduced in version 4.0.0 (September 2022) as part of an \"Improve JSON Patch implementation\" commit, years after version 2.6.23.RELEASE. This version uses a simple path-to-SpEL conversion that lacks any Map-typed property handling, making the described SpEL injection attack impossible.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41729" }, "impact_statement": "Version 2.6.23.RELEASE is not affected by CVE-2026-41729. The vulnerable code pattern (JsonPointerMapping class and Map-specific SpEL generation) was introduced in version 4.0.0 (September 2022) as part of an \"Improve JSON Patch implementation\" commit, years after version 2.6.23.RELEASE. This version uses a simple path-to-SpEL conversion that lacks any Map-typed property handling, making the described SpEL injection attack impossible." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@2.6.23.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@2.6.23.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-06T14:48:00.048187+00:00", "status_notes": "Vulnerability CVE-2026-41730 is fixed in version 2.6.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-rest-core.", "vulnerability": { "name": "CVE-2026-41730" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@2.6.23.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@2.6.23.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-06T14:48:00.048187+00:00", "status_notes": "Vulnerability CVE-2026-41837 is fixed in version 2.6.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-rest-core.", "vulnerability": { "name": "CVE-2026-41837" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@2.6.23.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@2.6.23.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-06T14:48:00.048187+00:00", "status_notes": "Vulnerability CVE-2026-47849 is fixed in version 2.6.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-rest-core.", "vulnerability": { "name": "CVE-2026-47849" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@2.6.23.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@2.6.23.RELEASE-tuxcare.1" } } ], "timestamp": "2026-11-06T14:48:00.048187+00:00", "status_notes": "Vulnerability CVE-2026-47850 is fixed in version 2.6.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-rest-core.", "vulnerability": { "name": "CVE-2026-47850" } } ] }