{
  "@id": "urn:uuid:4d7f4cc7-17cc-430e-984d-b0c0bfae6b67",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T15:03:00.038623+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-03T05:09:00.111687+00:00",
      "status_notes": "Vulnerability CVE-2023-34040 does not affect version 3.2.10-tuxcare.3 of org.springframework.kafka:spring-kafka. not_affected \u2014 The target Spring Kafka 3.2.10-tuxcare.3 is NOT AFFECTED by CVE-2023-34040. The vulnerability (arbitrary Java object deserialization via malicious headers) is not present because the upstream vendor fix was already included in Spring Kafka version 3.2.10 when TuxCare onboarded it. The fix introduces a package-private DeserializationExceptionHeader class and defensive checks that reject foreign ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34040"
      },
      "impact_statement": "not_affected \u2014 The target Spring Kafka 3.2.10-tuxcare.3 is NOT AFFECTED by CVE-2023-34040. The vulnerability (arbitrary Java object deserialization via malicious headers) is not present because the upstream vendor fix was already included in Spring Kafka version 3.2.10 when TuxCare onboarded it. The fix introduces a package-private DeserializationExceptionHeader class and defensive checks that reject foreign ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-22T13:49:34.986651+00:00",
      "status_notes": "Vulnerability CVE-2026-41726 affects version 3.2.10-tuxcare.3 of org.springframework.kafka:spring-kafka.",
      "vulnerability": {
        "name": "CVE-2026-41726"
      },
      "action_statement": "Vulnerability CVE-2026-41726 affects version 3.2.10-tuxcare.3 of org.springframework.kafka:spring-kafka."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:00.038623+00:00",
      "status_notes": "Vulnerability CVE-2026-41727 affects version 3.2.10-tuxcare.3 of org.springframework.kafka:spring-kafka, and is fixed in 3.2.10-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41727"
      },
      "action_statement": "Vulnerability CVE-2026-41727 affects version 3.2.10-tuxcare.3 of org.springframework.kafka:spring-kafka, and is fixed in 3.2.10-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-22T13:49:34.986651+00:00",
      "status_notes": "Vulnerability CVE-2026-41731 affects version 3.2.10-tuxcare.3 of org.springframework.kafka:spring-kafka.",
      "vulnerability": {
        "name": "CVE-2026-41731"
      },
      "action_statement": "Vulnerability CVE-2026-41731 affects version 3.2.10-tuxcare.3 of org.springframework.kafka:spring-kafka."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:00.038623+00:00",
      "status_notes": "Vulnerability CVE-2026-59278 affects version 3.2.10-tuxcare.3 of org.springframework.kafka:spring-kafka, and is fixed in 3.2.10-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-59278"
      },
      "action_statement": "Vulnerability CVE-2026-59278 affects version 3.2.10-tuxcare.3 of org.springframework.kafka:spring-kafka, and is fixed in 3.2.10-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:00.038623+00:00",
      "status_notes": "Vulnerability CVE-2026-59317 affects version 3.2.10-tuxcare.3 of org.springframework.kafka:spring-kafka, and is fixed in 3.2.10-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-59317"
      },
      "action_statement": "Vulnerability CVE-2026-59317 affects version 3.2.10-tuxcare.3 of org.springframework.kafka:spring-kafka, and is fixed in 3.2.10-tuxcare.4."
    }
  ]
}