{
  "@id": "urn:uuid:55b31fa9-0e2e-48e2-8acf-ffa1c65d16e6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator@3.2.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator@3.2.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T14:08:25.182757+00:00",
      "status_notes": "Vulnerability CVE-2023-34055 does not affect version 3.2.12-tuxcare.3 of org.springframework.boot:spring-boot-actuator. not_affected \u2014 Spring Boot 3.2.12 is not affected by CVE-2023-34055. The vulnerable classes WebFluxTags.java and WebMvcTags.java, which created unbounded Tag instances for arbitrary HTTP method names, were architecturally removed in Spring Boot 3.2.x during the migration to the Micrometer Observation API (commit b645eb32ac, June 2023). The CVE affects versions 2.7.0-2.7.17, 3.0.0-3.0.12, and 3.1.0-3.1.5, all ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34055"
      },
      "impact_statement": "not_affected \u2014 Spring Boot 3.2.12 is not affected by CVE-2023-34055. The vulnerable classes WebFluxTags.java and WebMvcTags.java, which created unbounded Tag instances for arbitrary HTTP method names, were architecturally removed in Spring Boot 3.2.x during the migration to the Micrometer Observation API (commit b645eb32ac, June 2023). The CVE affects versions 2.7.0-2.7.17, 3.0.0-3.0.12, and 3.1.0-3.1.5, all ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator@3.2.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator@3.2.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T18:36:42.887038+00:00",
      "status_notes": "Vulnerability CVE-2026-22731 affects version 3.2.12-tuxcare.3 of org.springframework.boot:spring-boot-actuator.",
      "vulnerability": {
        "name": "CVE-2026-22731"
      },
      "action_statement": "Vulnerability CVE-2026-22731 affects version 3.2.12-tuxcare.3 of org.springframework.boot:spring-boot-actuator."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator@3.2.12-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator@3.2.12-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22733 is fixed in version 3.2.12-tuxcare.3 of org.springframework.boot:spring-boot-actuator.",
      "vulnerability": {
        "name": "CVE-2026-22733"
      }
    }
  ]
}