{
  "@id": "urn:uuid:6434a462-08ed-4116-a8aa-6fcf359dafda",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T22:27:00.075478+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.hateoas/spring-hateoas@2.2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.hateoas/spring-hateoas@2.2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T22:27:00.075478+00:00",
      "status_notes": "Vulnerability CVE-2023-34036 does not affect version 2.2.5-tuxcare.2 of org.springframework.hateoas:spring-hateoas. not_affected \u2014 CVE-2023-34036 affects reactive web applications using Spring HATEOAS that process malicious X-Forwarded-* headers. The target repository spring-hateoas version 2.2.5-tuxcare.2 is NOT AFFECTED because the fix was already present in the upstream release 2.2.5 when TuxCare onboarded it. The vulnerable code pattern (UriComponentsBuilder.fromHttpRequest) has been replaced with the secure pattern (U...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34036"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-34036 affects reactive web applications using Spring HATEOAS that process malicious X-Forwarded-* headers. The target repository spring-hateoas version 2.2.5-tuxcare.2 is NOT AFFECTED because the fix was already present in the upstream release 2.2.5 when TuxCare onboarded it. The vulnerable code pattern (UriComponentsBuilder.fromHttpRequest) has been replaced with the secure pattern (U..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.hateoas/spring-hateoas@2.2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.hateoas/spring-hateoas@2.2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T07:40:25.121069+00:00",
      "status_notes": "Vulnerability CVE-2026-41006 is fixed in version 2.2.5-tuxcare.2 of org.springframework.hateoas:spring-hateoas.",
      "vulnerability": {
        "name": "CVE-2026-41006"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.hateoas/spring-hateoas@2.2.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.hateoas/spring-hateoas@2.2.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T07:40:25.121069+00:00",
      "status_notes": "Vulnerability CVE-2026-41007 is fixed in version 2.2.5-tuxcare.2 of org.springframework.hateoas:spring-hateoas.",
      "vulnerability": {
        "name": "CVE-2026-41007"
      }
    }
  ]
}