{
  "@id": "urn:uuid:e8fbd4f0-550a-4a64-b62b-ac6367b25e55",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:42:17.982041+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator@3.4.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator@3.4.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T14:11:55.158938+00:00",
      "status_notes": "Vulnerability CVE-2023-34055 does not affect version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator. not_affected \u2014 Spring Boot 3.4.13 is not affected by CVE-2023-34055. The vulnerable WebMvcTags and WebFluxTags classes that used raw HTTP method strings for metrics tags were removed in Spring Boot 3.2 (June 2023, commit b645eb32ac) before the CVE was discovered. Version 3.4.13 uses Spring Framework's Observation API (DefaultServerRequestObservationConvention) for HTTP metrics, which is a different architectu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34055"
      },
      "impact_statement": "not_affected \u2014 Spring Boot 3.4.13 is not affected by CVE-2023-34055. The vulnerable WebMvcTags and WebFluxTags classes that used raw HTTP method strings for metrics tags were removed in Spring Boot 3.2 (June 2023, commit b645eb32ac) before the CVE was discovered. Version 3.4.13 uses Spring Framework's Observation API (DefaultServerRequestObservationConvention) for HTTP metrics, which is a different architectu..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator@3.4.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator@3.4.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22731 is fixed in version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator.",
      "vulnerability": {
        "name": "CVE-2026-22731"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-actuator@3.4.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-actuator@3.4.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22733 is fixed in version 3.4.13-tuxcare.2 of org.springframework.boot:spring-boot-actuator.",
      "vulnerability": {
        "name": "CVE-2026-22733"
      }
    }
  ]
}