{
  "@id": "urn:uuid:86135ddf-028a-4925-b93b-fed83b6c536f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T15:24:32.016645+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T05:09:00.111687+00:00",
      "status_notes": "Vulnerability CVE-2023-34040 does not affect version 3.0.13-tuxcare.2 of org.springframework.kafka:spring-kafka. not_affected \u2014 The target Spring Kafka 3.0.13 is not affected by CVE-2023-34040. The vulnerability's fix (package-private DeserializationExceptionHeader class with instanceof type checks) was already present in the upstream Spring Kafka 3.0.13 release when TuxCare onboarded it. The fix prevents deserialization of arbitrary objects in exception headers by restricting processing to only headers of the specific ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34040"
      },
      "impact_statement": "not_affected \u2014 The target Spring Kafka 3.0.13 is not affected by CVE-2023-34040. The vulnerability's fix (package-private DeserializationExceptionHeader class with instanceof type checks) was already present in the upstream Spring Kafka 3.0.13 release when TuxCare onboarded it. The fix prevents deserialization of arbitrary objects in exception headers by restricting processing to only headers of the specific ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T13:58:37.049462+00:00",
      "status_notes": "Vulnerability CVE-2026-41726 affects version 3.0.13-tuxcare.2 of org.springframework.kafka:spring-kafka.",
      "vulnerability": {
        "name": "CVE-2026-41726"
      },
      "action_statement": "Vulnerability CVE-2026-41726 affects version 3.0.13-tuxcare.2 of org.springframework.kafka:spring-kafka."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T15:24:32.016645+00:00",
      "status_notes": "Vulnerability CVE-2026-41727 affects version 3.0.13-tuxcare.2 of org.springframework.kafka:spring-kafka, and is fixed in 3.0.13-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41727"
      },
      "action_statement": "Vulnerability CVE-2026-41727 affects version 3.0.13-tuxcare.2 of org.springframework.kafka:spring-kafka, and is fixed in 3.0.13-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-22T13:58:37.049462+00:00",
      "status_notes": "Vulnerability CVE-2026-41731 affects version 3.0.13-tuxcare.2 of org.springframework.kafka:spring-kafka.",
      "vulnerability": {
        "name": "CVE-2026-41731"
      },
      "action_statement": "Vulnerability CVE-2026-41731 affects version 3.0.13-tuxcare.2 of org.springframework.kafka:spring-kafka."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:39:17.536668+00:00",
      "status_notes": "Vulnerability CVE-2026-59278 affects version 3.0.13-tuxcare.2 of org.springframework.kafka:spring-kafka, and is fixed in 3.0.13-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-59278"
      },
      "action_statement": "Vulnerability CVE-2026-59278 affects version 3.0.13-tuxcare.2 of org.springframework.kafka:spring-kafka, and is fixed in 3.0.13-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T16:39:17.536668+00:00",
      "status_notes": "Vulnerability CVE-2026-59317 affects version 3.0.13-tuxcare.2 of org.springframework.kafka:spring-kafka, and is fixed in 3.0.13-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-59317"
      },
      "action_statement": "Vulnerability CVE-2026-59317 affects version 3.0.13-tuxcare.2 of org.springframework.kafka:spring-kafka, and is fixed in 3.0.13-tuxcare.3."
    }
  ]
}