{
  "@id": "urn:uuid:f2417a3e-6ebd-4d13-bd33-2c5f430127b5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T22:25:48.781222+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.hateoas/spring-hateoas@1.5.6.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.hateoas/spring-hateoas@1.5.6.tuxcare"
          }
        }
      ],
      "timestamp": "2026-11-02T22:25:48.781222+00:00",
      "status_notes": "Vulnerability CVE-2023-34036 does not affect version 1.5.6.tuxcare of org.springframework.hateoas:spring-hateoas. not_affected \u2014 The target repository spring-hateoas version 1.5.6-tuxcare.8 is NOT affected by CVE-2023-34036. The vulnerability pattern (trusting malicious forwarded headers when building hypermedia links in reactive WebFlux applications) is absent because the upstream vendor fix was already present in the release that TuxCare onboarded. The fix changes WebFluxLinkBuilder.java line 291 from `UriComponentsBui...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34036"
      },
      "impact_statement": "not_affected \u2014 The target repository spring-hateoas version 1.5.6-tuxcare.8 is NOT affected by CVE-2023-34036. The vulnerability pattern (trusting malicious forwarded headers when building hypermedia links in reactive WebFlux applications) is absent because the upstream vendor fix was already present in the release that TuxCare onboarded. The fix changes WebFluxLinkBuilder.java line 291 from `UriComponentsBui..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.hateoas/spring-hateoas@1.5.6.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.hateoas/spring-hateoas@1.5.6.tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41006 affects version 1.5.6.tuxcare of org.springframework.hateoas:spring-hateoas, and is fixed in 1.5.6-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41006"
      },
      "action_statement": "Vulnerability CVE-2026-41006 affects version 1.5.6.tuxcare of org.springframework.hateoas:spring-hateoas, and is fixed in 1.5.6-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.hateoas/spring-hateoas@1.5.6.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.hateoas/spring-hateoas@1.5.6.tuxcare"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41007 affects version 1.5.6.tuxcare of org.springframework.hateoas:spring-hateoas, and is fixed in 1.5.6-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41007"
      },
      "action_statement": "Vulnerability CVE-2026-41007 affects version 1.5.6.tuxcare of org.springframework.hateoas:spring-hateoas, and is fixed in 1.5.6-tuxcare.4."
    }
  ]
}