{
  "@id": "urn:uuid:022ef6c4-b181-49ab-b107-3eb6d74f3101",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T20:56:00.075843+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:02:52.397356+00:00",
      "status_notes": "Vulnerability CVE-2023-20883 does not affect version 3.2.12-tuxcare.2 of org.springframework.boot:spring-boot-autoconfigure. Spring Boot 3.2.12 is not affected by CVE-2023-20883. The vulnerability was fixed in upstream Spring Boot 3.0.7 (May 2023) and the fix was already present in the upstream 3.2.12 release (November 2023) when TuxCare onboarded it. The fix introduces WelcomePageNotAcceptableHandlerMapping which returns HTTP 406 (Not Acceptable) when a welcome page exists but cannot be accepted by the request's Accept header, preventing reverse proxies from caching 404 responses that would cause denial of service.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.0.0, < 3.0.7; >= 2.7.0, < 2.7.12; >= 2.6.0, < 2.6.15; < 2.5.15), NVD (< 2.5.14; >= 2.6.0, <= 2.6.14; >= 2.7.0, <= 2.7.11; >= 3.0.0, <= 3.0.6), cve.org (>= 3.0.0, <= 3.0.6; >= 2.7.0, <= 2.7.11; >= 2.6.0, <= 2.6.14; >= 2.5.0, <= 2.5.14), Snyk (< 2.5.15; >= 2.6.0, < 2.6.15; >= 2.7.0, < 2.7.12; >= 3.0.0, < 3.0.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20883"
      },
      "impact_statement": "Spring Boot 3.2.12 is not affected by CVE-2023-20883. The vulnerability was fixed in upstream Spring Boot 3.0.7 (May 2023) and the fix was already present in the upstream 3.2.12 release (November 2023) when TuxCare onboarded it. The fix introduces WelcomePageNotAcceptableHandlerMapping which returns HTTP 406 (Not Acceptable) when a welcome page exists but cannot be accepted by the request's Accept header, preventing reverse proxies from caching 404 responses that would cause denial of service.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.0.0, < 3.0.7; >= 2.7.0, < 2.7.12; >= 2.6.0, < 2.6.15; < 2.5.15), NVD (< 2.5.14; >= 2.6.0, <= 2.6.14; >= 2.7.0, <= 2.7.11; >= 3.0.0, <= 3.0.6), cve.org (>= 3.0.0, <= 3.0.6; >= 2.7.0, <= 2.7.11; >= 2.6.0, <= 2.6.14; >= 2.5.0, <= 2.5.14), Snyk (< 2.5.15; >= 2.6.0, < 2.6.15; >= 2.7.0, < 2.7.12; >= 3.0.0, < 3.0.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T20:56:00.075843+00:00",
      "status_notes": "Vulnerability CVE-2026-40971 does not affect version 3.2.12-tuxcare.2 of org.springframework.boot:spring-boot-autoconfigure. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. Hostname verification defaults to true (RabbitProperties.java:463). The configurer assigns the SSL bundle and then maps that verification setting outside the bundle/non-bundle split (RabbitConnectionFactoryBeanConfigurer.java:135, line 154). PropertyMapper uses an unconditional predicate here and invokes the setter synchronously (PropertyMapper.java:131, line 290). Auto-configuration calls configure before afterPropertiesSet and getObject, so initialization follows the flag assignment (RabbitAutoConfiguration.java:127). The overridden setter stores the flag, and the bundle setup calls enableHostnameVerification after installing the SSLContext, providing equivalent protection for this CVE (SslBundleRabbitConnectionFactoryBean.java:52, line 35).",
      "vulnerability": {
        "name": "CVE-2026-40971"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. Hostname verification defaults to true (RabbitProperties.java:463). The configurer assigns the SSL bundle and then maps that verification setting outside the bundle/non-bundle split (RabbitConnectionFactoryBeanConfigurer.java:135, line 154). PropertyMapper uses an unconditional predicate here and invokes the setter synchronously (PropertyMapper.java:131, line 290). Auto-configuration calls configure before afterPropertiesSet and getObject, so initialization follows the flag assignment (RabbitAutoConfiguration.java:127). The overridden setter stores the flag, and the bundle setup calls enableHostnameVerification after installing the SSLContext, providing equivalent protection for this CVE (SslBundleRabbitConnectionFactoryBean.java:52, line 35)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T12:55:53.554317+00:00",
      "status_notes": "Vulnerability CVE-2026-40974 affects version 3.2.12-tuxcare.2 of org.springframework.boot:spring-boot-autoconfigure, and is fixed in 3.2.12-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-40974"
      },
      "action_statement": "Vulnerability CVE-2026-40974 affects version 3.2.12-tuxcare.2 of org.springframework.boot:spring-boot-autoconfigure, and is fixed in 3.2.12-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40992 does not affect version 3.2.12-tuxcare.2 of org.springframework.boot:spring-boot-autoconfigure. not_affected \u2014 Spring Boot 3.2.12 is not affected by CVE-2026-40992. The vulnerability concerns incomplete SSL auto-configuration (enabling SSL without hostname verification) in Spring Boot's mail module, introduced in version 3.4.0 with the MailProperties.Ssl class and related auto-configuration logic. Version 3.2.12 predates this feature and has no SSL auto-configuration for mail - it only passes through us...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40992"
      },
      "impact_statement": "not_affected \u2014 Spring Boot 3.2.12 is not affected by CVE-2026-40992. The vulnerability concerns incomplete SSL auto-configuration (enabling SSL without hostname verification) in Spring Boot's mail module, introduced in version 3.4.0 with the MailProperties.Ssl class and related auto-configuration logic. Version 3.2.12 predates this feature and has no SSL auto-configuration for mail - it only passes through us..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.2.12-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-autoconfigure@3.2.12-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-26T12:55:53.554317+00:00",
      "status_notes": "Vulnerability CVE-2026-41001 affects version 3.2.12-tuxcare.2 of org.springframework.boot:spring-boot-autoconfigure, and is fixed in 3.2.12-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-41001"
      },
      "action_statement": "Vulnerability CVE-2026-41001 affects version 3.2.12-tuxcare.2 of org.springframework.boot:spring-boot-autoconfigure, and is fixed in 3.2.12-tuxcare.5."
    }
  ]
}