{
  "@id": "urn:uuid:04b26c7b-e5c6-4a04-b340-b760cf6fff84",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.4.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.4.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-20883 is fixed in version 2.4.5-tuxcare.3 of org.springframework.boot:spring-boot-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2023-20883"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.4.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.4.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-38286 affects version 2.4.5-tuxcare.3 of org.springframework.boot:spring-boot-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2023-38286"
      },
      "action_statement": "Vulnerability CVE-2023-38286 affects version 2.4.5-tuxcare.3 of org.springframework.boot:spring-boot-autoconfigure."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.4.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.4.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T06:44:17.049175+00:00",
      "status_notes": "Vulnerability CVE-2026-40971 does not affect version 2.4.5-tuxcare.3 of org.springframework.boot:spring-boot-autoconfigure. not_affected \u2014 Spring Boot 2.4.5 does not have the SSL bundle feature that CVE-2026-40971 describes. The vulnerability is specific to SSL bundle usage in RabbitMQ auto-configuration, which was introduced in Spring Boot 3.x (commit 5556739c8c, October 2023). The target version only supports SSL via RabbitProperties.Ssl properties, where hostname verification defaults to true and is properly applied on line 148...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40971"
      },
      "impact_statement": "not_affected \u2014 Spring Boot 2.4.5 does not have the SSL bundle feature that CVE-2026-40971 describes. The vulnerability is specific to SSL bundle usage in RabbitMQ auto-configuration, which was introduced in Spring Boot 3.x (commit 5556739c8c, October 2023). The target version only supports SSL via RabbitProperties.Ssl properties, where hostname verification defaults to true and is properly applied on line 148..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.4.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.4.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40974 affects version 2.4.5-tuxcare.3 of org.springframework.boot:spring-boot-autoconfigure, and is fixed in 2.4.5-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-40974"
      },
      "action_statement": "Vulnerability CVE-2026-40974 affects version 2.4.5-tuxcare.3 of org.springframework.boot:spring-boot-autoconfigure, and is fixed in 2.4.5-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.4.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.4.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40992 does not affect version 2.4.5-tuxcare.3 of org.springframework.boot:spring-boot-autoconfigure. not_affected \u2014 Spring Boot 2.7.18 is not affected by CVE-2026-40992. The vulnerability exists in the SSL auto-configuration feature introduced in Spring Boot 3.x/4.x (controlled via spring.mail.ssl.enabled and spring.mail.ssl.bundle properties). This SSL auto-configuration feature does not exist in version 2.7.18. In 2.7.18, users must manually configure all JavaMail properties via spring.mail.properties.*, i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40992"
      },
      "impact_statement": "not_affected \u2014 Spring Boot 2.7.18 is not affected by CVE-2026-40992. The vulnerability exists in the SSL auto-configuration feature introduced in Spring Boot 3.x/4.x (controlled via spring.mail.ssl.enabled and spring.mail.ssl.bundle properties). This SSL auto-configuration feature does not exist in version 2.7.18. In 2.7.18, users must manually configure all JavaMail properties via spring.mail.properties.*, i..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.4.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.4.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41001 affects version 2.4.5-tuxcare.3 of org.springframework.boot:spring-boot-autoconfigure, and is fixed in 2.4.5-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41001"
      },
      "action_statement": "Vulnerability CVE-2026-41001 affects version 2.4.5-tuxcare.3 of org.springframework.boot:spring-boot-autoconfigure, and is fixed in 2.4.5-tuxcare.4."
    }
  ]
}