{
  "@id": "urn:uuid:3d969d2e-f232-4c2c-bf1f-64ddfd3146e6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 17,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:13:00.045658+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:18:37.630490+00:00",
      "status_notes": "Vulnerability CVE-2023-20873 does not affect version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure. Version 3.4.13 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-g5h3-w546-pj7f (affected below 3.0.6), NVD (affected below 3.0.6), CVE record (affected up to 3.0.5), Snyk (affected below 3.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20873"
      },
      "impact_statement": "Version 3.4.13 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-g5h3-w546-pj7f (affected below 3.0.6), NVD (affected below 3.0.6), CVE record (affected up to 3.0.5), Snyk (affected below 3.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T17:24:21.599166+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 does not affect version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 3.4.5, and version 3.4.13 is a later release of the same line. Advisories: GitHub GHSA-rc42-6c7j-7h5r (fixed in 3.4.5), CVE record (fixed in 3.4.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22235"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 3.4.5, and version 3.4.13 is a later release of the same line. Advisories: GitHub GHSA-rc42-6c7j-7h5r (fixed in 3.4.5), CVE record (fixed in 3.4.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator-autoconfigure@3.4.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T04:13:00.045658+00:00",
      "status_notes": "Vulnerability CVE-2026-40976 does not affect version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator-autoconfigure. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its default servlet security chain always configures authorization, so the vulnerable omission cannot occur. In spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfiguration.java:65, the chain permits health requests and requires authentication for every other request.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-40976"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because its default servlet security chain always configures authorization, so the vulnerable omission cannot occur. In spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfiguration.java:65, the chain permits health requests and requires authentication for every other request."
    }
  ]
}