{
  "@id": "urn:uuid:b89e2322-5e0a-4dbc-b2b8-e867ec0d8aa8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T15:24:32.016645+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:24:24.580932+00:00",
      "status_notes": "Vulnerability CVE-2023-34040 does not affect version 3.0.13-tuxcare.4 of org.springframework.kafka:spring-kafka. not_affected \u2014 The target Spring Kafka 3.0.13 is not affected by CVE-2023-34040. The vulnerability's fix (package-private DeserializationExceptionHeader class with instanceof type checks) was already present in the upstream Spring Kafka 3.0.13 release when TuxCare onboarded it. The fix prevents deserialization of arbitrary objects in exception headers by restricting processing to only headers of the specific ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34040"
      },
      "impact_statement": "not_affected \u2014 The target Spring Kafka 3.0.13 is not affected by CVE-2023-34040. The vulnerability's fix (package-private DeserializationExceptionHeader class with instanceof type checks) was already present in the upstream Spring Kafka 3.0.13 release when TuxCare onboarded it. The fix prevents deserialization of arbitrary objects in exception headers by restricting processing to only headers of the specific ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:24:24.580932+00:00",
      "status_notes": "Vulnerability CVE-2026-41726 affects version 3.0.13-tuxcare.4 of org.springframework.kafka:spring-kafka.",
      "vulnerability": {
        "name": "CVE-2026-41726"
      },
      "action_statement": "Vulnerability CVE-2026-41726 affects version 3.0.13-tuxcare.4 of org.springframework.kafka:spring-kafka."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:24:32.016645+00:00",
      "status_notes": "Vulnerability CVE-2026-41727 is fixed in version 3.0.13-tuxcare.4 of org.springframework.kafka:spring-kafka.",
      "vulnerability": {
        "name": "CVE-2026-41727"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:24:24.580932+00:00",
      "status_notes": "Vulnerability CVE-2026-41731 affects version 3.0.13-tuxcare.4 of org.springframework.kafka:spring-kafka.",
      "vulnerability": {
        "name": "CVE-2026-41731"
      },
      "action_statement": "Vulnerability CVE-2026-41731 affects version 3.0.13-tuxcare.4 of org.springframework.kafka:spring-kafka."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:24:24.580932+00:00",
      "status_notes": "Vulnerability CVE-2026-59278 is fixed in version 3.0.13-tuxcare.4 of org.springframework.kafka:spring-kafka.",
      "vulnerability": {
        "name": "CVE-2026-59278"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.0.13-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:24:24.580932+00:00",
      "status_notes": "Vulnerability CVE-2026-59317 is fixed in version 3.0.13-tuxcare.4 of org.springframework.kafka:spring-kafka.",
      "vulnerability": {
        "name": "CVE-2026-59317"
      }
    }
  ]
}