{
  "@id": "urn:uuid:26e7da0b-ad6a-4ee3-82c9-d6a398eb7d83",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T14:27:43.708654+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.7.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.7.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T14:27:43.708654+00:00",
      "status_notes": "Vulnerability CVE-2023-20883 affects version 2.7.7-tuxcare.2 of org.springframework.boot:spring-boot-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2023-20883"
      },
      "action_statement": "Vulnerability CVE-2023-20883 affects version 2.7.7-tuxcare.2 of org.springframework.boot:spring-boot-autoconfigure."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.7.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.7.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T14:27:43.708654+00:00",
      "status_notes": "Vulnerability CVE-2026-40971 does not affect version 2.7.7-tuxcare.2 of org.springframework.boot:spring-boot-autoconfigure. not_affected \u2014 Spring Boot 2.7.7 is NOT affected by CVE-2026-40971. The vulnerability exists specifically in Spring Boot 3.x's SSL bundle configuration feature, which does not exist in the 2.7.x series. The target only supports SSL configuration via properties (not SSL bundles), and this path correctly applies hostname verification with a secure default (verifyHostname=true).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40971"
      },
      "impact_statement": "not_affected \u2014 Spring Boot 2.7.7 is NOT affected by CVE-2026-40971. The vulnerability exists specifically in Spring Boot 3.x's SSL bundle configuration feature, which does not exist in the 2.7.x series. The target only supports SSL configuration via properties (not SSL bundles), and this path correctly applies hostname verification with a secure default (verifyHostname=true)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.7.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.7.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T14:27:43.708654+00:00",
      "status_notes": "Vulnerability CVE-2026-40974 affects version 2.7.7-tuxcare.2 of org.springframework.boot:spring-boot-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2026-40974"
      },
      "action_statement": "Vulnerability CVE-2026-40974 affects version 2.7.7-tuxcare.2 of org.springframework.boot:spring-boot-autoconfigure."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.7.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.7.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T14:27:43.708654+00:00",
      "status_notes": "Vulnerability CVE-2026-40992 affects version 2.7.7-tuxcare.2 of org.springframework.boot:spring-boot-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2026-40992"
      },
      "action_statement": "Vulnerability CVE-2026-40992 affects version 2.7.7-tuxcare.2 of org.springframework.boot:spring-boot-autoconfigure."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.7.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@2.7.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T14:27:43.708654+00:00",
      "status_notes": "Vulnerability CVE-2026-41001 affects version 2.7.7-tuxcare.2 of org.springframework.boot:spring-boot-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2026-41001"
      },
      "action_statement": "Vulnerability CVE-2026-41001 affects version 2.7.7-tuxcare.2 of org.springframework.boot:spring-boot-autoconfigure."
    }
  ]
}