{ "@id": "urn:uuid:eb73a856-50c7-44a7-b436-ac191aca7a90", "role": "Document Creator", "author": "https://tuxcare.com", "version": 7, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-11T16:02:00.041384+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@3.5.12-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@3.5.12-tuxcare.2" } } ], "timestamp": "2026-11-01T20:45:12.913197+00:00", "status_notes": "Vulnerability CVE-2017-8046 affects version 3.5.12-tuxcare.2 of org.springframework.data:spring-data-rest-core.", "vulnerability": { "name": "CVE-2017-8046" }, "action_statement": "Vulnerability CVE-2017-8046 affects version 3.5.12-tuxcare.2 of org.springframework.data:spring-data-rest-core." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@3.5.12-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@3.5.12-tuxcare.2" } } ], "timestamp": "2026-11-03T05:07:00.110206+00:00", "status_notes": "Vulnerability CVE-2021-22047 does not affect version 3.5.12-tuxcare.2 of org.springframework.data:spring-data-rest-core. not_affected \u2014 CVE-2021-22047 is not present in spring-data-rest 3.5.12. The vulnerable pattern (double registration of controllers with @RepositoryRestController/@BasePathAwareController + class-level @RequestMapping) was fixed by upstream in version 3.5.6. The target version 3.5.12 was onboarded by TuxCare after the upstream fix was released, so the vulnerable code is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-22047" }, "impact_statement": "not_affected \u2014 CVE-2021-22047 is not present in spring-data-rest 3.5.12. The vulnerable pattern (double registration of controllers with @RepositoryRestController/@BasePathAwareController + class-level @RequestMapping) was fixed by upstream in version 3.5.6. The target version 3.5.12 was onboarded by TuxCare after the upstream fix was released, so the vulnerable code is not present." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@3.5.12-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@3.5.12-tuxcare.2" } } ], "timestamp": "2026-10-29T00:29:56.875680+00:00", "status_notes": "Vulnerability CVE-2022-31679 affects version 3.5.12-tuxcare.2 of org.springframework.data:spring-data-rest-core.", "vulnerability": { "name": "CVE-2022-31679" }, "action_statement": "Vulnerability CVE-2022-31679 affects version 3.5.12-tuxcare.2 of org.springframework.data:spring-data-rest-core." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@3.5.12-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@3.5.12-tuxcare.2" } } ], "timestamp": "2026-11-11T16:02:00.041384+00:00", "status_notes": "Vulnerability CVE-2026-41728 affects version 3.5.12-tuxcare.2 of org.springframework.data:spring-data-rest-core, and is fixed in 3.5.12-tuxcare.3.", "vulnerability": { "name": "CVE-2026-41728" }, "action_statement": "Vulnerability CVE-2026-41728 affects version 3.5.12-tuxcare.2 of org.springframework.data:spring-data-rest-core, and is fixed in 3.5.12-tuxcare.3." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@3.5.12-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@3.5.12-tuxcare.2" } } ], "timestamp": "2026-10-22T09:37:33.224982+00:00", "status_notes": "Vulnerability CVE-2026-41729 is fixed in version 3.5.12-tuxcare.2 of org.springframework.data:spring-data-rest-core.", "vulnerability": { "name": "CVE-2026-41729" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@3.5.12-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@3.5.12-tuxcare.2" } } ], "timestamp": "2026-10-22T09:37:33.224982+00:00", "status_notes": "Vulnerability CVE-2026-41730 is fixed in version 3.5.12-tuxcare.2 of org.springframework.data:spring-data-rest-core.", "vulnerability": { "name": "CVE-2026-41730" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@3.5.12-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@3.5.12-tuxcare.2" } } ], "timestamp": "2026-10-22T09:37:33.224982+00:00", "status_notes": "Vulnerability CVE-2026-41837 is fixed in version 3.5.12-tuxcare.2 of org.springframework.data:spring-data-rest-core.", "vulnerability": { "name": "CVE-2026-41837" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@3.5.12-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@3.5.12-tuxcare.2" } } ], "timestamp": "2026-10-22T09:38:00.167227+00:00", "status_notes": "Vulnerability CVE-2026-47849 is fixed in version 3.5.12-tuxcare.2 of org.springframework.data:spring-data-rest-core.", "vulnerability": { "name": "CVE-2026-47849" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.data/spring-data-rest-core@3.5.12-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.data/spring-data-rest-core@3.5.12-tuxcare.2" } } ], "timestamp": "2026-10-22T09:38:00.167227+00:00", "status_notes": "Vulnerability CVE-2026-47850 is fixed in version 3.5.12-tuxcare.2 of org.springframework.data:spring-data-rest-core.", "vulnerability": { "name": "CVE-2026-47850" } } ] }