{
  "@id": "urn:uuid:9f40de48-154c-4ea6-831a-60ba6690dd68",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 13,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:02:52.397356+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.1.8-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.1.8-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-03T12:02:52.397356+00:00",
      "status_notes": "Vulnerability CVE-2023-20883 does not affect version 3.1.8-tuxcare.6 of org.springframework.boot:spring-boot-autoconfigure. Spring Boot 3.1.8 is not affected by CVE-2023-20883. The vulnerability was fixed in upstream Spring Boot 3.0.7 (released May 18, 2023) via commit 418dd1ba5b, and that fix was already present in the 3.1.8 release that TuxCare onboarded. The target version 3.1.8 is newer than the affected version range (3.0.0-3.0.6) and contains the complete fix: WelcomePageNotAcceptableHandlerMapping returns HTTP 406 instead of 404 when a welcome page exists but cannot be served due to Accept header mismatch, preventing reverse proxy cache pollution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.0.0, < 3.0.7; >= 2.7.0, < 2.7.12; >= 2.6.0, < 2.6.15; < 2.5.15), NVD (< 2.5.14; >= 2.6.0, <= 2.6.14; >= 2.7.0, <= 2.7.11; >= 3.0.0, <= 3.0.6), cve.org (>= 3.0.0, <= 3.0.6; >= 2.7.0, <= 2.7.11; >= 2.6.0, <= 2.6.14; >= 2.5.0, <= 2.5.14), Snyk (< 2.5.15; >= 2.6.0, < 2.6.15; >= 2.7.0, < 2.7.12; >= 3.0.0, < 3.0.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20883"
      },
      "impact_statement": "Spring Boot 3.1.8 is not affected by CVE-2023-20883. The vulnerability was fixed in upstream Spring Boot 3.0.7 (released May 18, 2023) via commit 418dd1ba5b, and that fix was already present in the 3.1.8 release that TuxCare onboarded. The target version 3.1.8 is newer than the affected version range (3.0.0-3.0.6) and contains the complete fix: WelcomePageNotAcceptableHandlerMapping returns HTTP 406 instead of 404 when a welcome page exists but cannot be served due to Accept header mismatch, preventing reverse proxy cache pollution.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.0.0, < 3.0.7; >= 2.7.0, < 2.7.12; >= 2.6.0, < 2.6.15; < 2.5.15), NVD (< 2.5.14; >= 2.6.0, <= 2.6.14; >= 2.7.0, <= 2.7.11; >= 3.0.0, <= 3.0.6), cve.org (>= 3.0.0, <= 3.0.6; >= 2.7.0, <= 2.7.11; >= 2.6.0, <= 2.6.14; >= 2.5.0, <= 2.5.14), Snyk (< 2.5.15; >= 2.6.0, < 2.6.15; >= 2.7.0, < 2.7.12; >= 3.0.0, < 3.0.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.1.8-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.1.8-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-29T06:44:17.049175+00:00",
      "status_notes": "Vulnerability CVE-2026-40971 does not affect version 3.1.8-tuxcare.6 of org.springframework.boot:spring-boot-autoconfigure. not_affected \u2014 Spring Boot version 3.1.8 is NOT AFFECTED by CVE-2026-40971. The vulnerability concerns missing hostname verification when using SSL bundles for RabbitMQ connections. However, SSL bundle support for RabbitMQ was introduced in Spring Boot 3.5.0 (as documented by the @since 3.5.0 annotation on RabbitConnectionDetails.getSslBundle()). Version 3.1.8 predates this feature and does not have any code ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40971"
      },
      "impact_statement": "not_affected \u2014 Spring Boot version 3.1.8 is NOT AFFECTED by CVE-2026-40971. The vulnerability concerns missing hostname verification when using SSL bundles for RabbitMQ connections. However, SSL bundle support for RabbitMQ was introduced in Spring Boot 3.5.0 (as documented by the @since 3.5.0 annotation on RabbitConnectionDetails.getSslBundle()). Version 3.1.8 predates this feature and does not have any code ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.1.8-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.1.8-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-10-13T17:18:00.098046+00:00",
      "status_notes": "Vulnerability CVE-2026-40974 affects version 3.1.8-tuxcare.6 of org.springframework.boot:spring-boot-autoconfigure.",
      "vulnerability": {
        "name": "CVE-2026-40974"
      },
      "action_statement": "Vulnerability CVE-2026-40974 affects version 3.1.8-tuxcare.6 of org.springframework.boot:spring-boot-autoconfigure."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.1.8-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.1.8-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40992 does not affect version 3.1.8-tuxcare.6 of org.springframework.boot:spring-boot-autoconfigure. not_affected \u2014 Spring Boot 2.7.18 is not affected by CVE-2026-40992. The vulnerability exists in the SSL autoconfiguration API (spring.mail.ssl.*) introduced in Spring Boot 3.4+, which does not exist in version 2.7.18. The target version only supports manual SSL configuration via spring.mail.properties.*, which the CVE explicitly excludes from its scope.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40992"
      },
      "impact_statement": "not_affected \u2014 Spring Boot 2.7.18 is not affected by CVE-2026-40992. The vulnerability exists in the SSL autoconfiguration API (spring.mail.ssl.*) introduced in Spring Boot 3.4+, which does not exist in version 2.7.18. The target version only supports manual SSL configuration via spring.mail.properties.*, which the CVE explicitly excludes from its scope."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.1.8-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.1.8-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41001 affects version 3.1.8-tuxcare.6 of org.springframework.boot:spring-boot-autoconfigure, and is fixed in 3.1.8-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-41001"
      },
      "action_statement": "Vulnerability CVE-2026-41001 affects version 3.1.8-tuxcare.6 of org.springframework.boot:spring-boot-autoconfigure, and is fixed in 3.1.8-tuxcare.9."
    }
  ]
}