{
  "@id": "urn:uuid:deaf651b-cb36-403b-9574-fa448e0923c9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T14:32:00.050379+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.1.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.1.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:31:37.039487+00:00",
      "status_notes": "Vulnerability CVE-2023-34040 does not affect version 3.1.5-tuxcare.2 of org.springframework.kafka:spring-kafka. not_affected \u2014 CVE-2023-34040 is NOT present in Spring Kafka 3.1.5. The vulnerability allowed deserialization attacks via malicious objects in Kafka record headers, but the fix was already included in the upstream Spring Kafka 3.1.5 release (applied in upstream version 3.0.10 on 2023-08-08, commit eb779679). The fix introduces a package-private DeserializationExceptionHeader class and validates that only legi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34040"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-34040 is NOT present in Spring Kafka 3.1.5. The vulnerability allowed deserialization attacks via malicious objects in Kafka record headers, but the fix was already included in the upstream Spring Kafka 3.1.5 release (applied in upstream version 3.0.10 on 2023-08-08, commit eb779679). The fix introduces a package-private DeserializationExceptionHeader class and validates that only legi..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.1.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.1.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:31:37.039487+00:00",
      "status_notes": "Vulnerability CVE-2026-41726 affects version 3.1.5-tuxcare.2 of org.springframework.kafka:spring-kafka.",
      "vulnerability": {
        "name": "CVE-2026-41726"
      },
      "action_statement": "Vulnerability CVE-2026-41726 affects version 3.1.5-tuxcare.2 of org.springframework.kafka:spring-kafka."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.1.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.1.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:32:00.050379+00:00",
      "status_notes": "Vulnerability CVE-2026-41727 is fixed in version 3.1.5-tuxcare.2 of org.springframework.kafka:spring-kafka.",
      "vulnerability": {
        "name": "CVE-2026-41727"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.1.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.1.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:31:37.039487+00:00",
      "status_notes": "Vulnerability CVE-2026-41731 affects version 3.1.5-tuxcare.2 of org.springframework.kafka:spring-kafka.",
      "vulnerability": {
        "name": "CVE-2026-41731"
      },
      "action_statement": "Vulnerability CVE-2026-41731 affects version 3.1.5-tuxcare.2 of org.springframework.kafka:spring-kafka."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.1.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.1.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:32:00.050379+00:00",
      "status_notes": "Vulnerability CVE-2026-59278 is fixed in version 3.1.5-tuxcare.2 of org.springframework.kafka:spring-kafka.",
      "vulnerability": {
        "name": "CVE-2026-59278"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.1.5-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.1.5-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:32:00.050379+00:00",
      "status_notes": "Vulnerability CVE-2026-59317 is fixed in version 3.1.5-tuxcare.2 of org.springframework.kafka:spring-kafka.",
      "vulnerability": {
        "name": "CVE-2026-59317"
      }
    }
  ]
}