{
  "@id": "urn:uuid:5de36587-25b4-4e6e-be97-d3e34f562ba2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 18,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T11:40:52.629939+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-devtools@3.5.16-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-devtools@3.5.16-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:52.629939+00:00",
      "status_notes": "Vulnerability CVE-2026-40972 does not affect version 3.5.16-tuxcare.5 of org.springframework.boot:spring-boot-devtools. The target Spring Boot version 3.5.16-tuxcare.8 is NOT affected by CVE-2026-40972. The vulnerability (timing attack on remote DevTools secret comparison) was fixed in the upstream Spring Boot 3.5.16 release before TuxCare onboarded it. The fix commit 4b0862cc00 by Andy Wilkinson (Broadcom) replaced the timing-vulnerable String.equals() comparison with constant-time MessageDigest.isEqual() on byte arrays. The vulnerable pattern (String-based equals comparison) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.6; >= 3.5.0, < 3.5.14; >= 3.4.0, <= 3.4.15; >= 3.3.0, <= 3.3.18; <= 2.7.32), NVD (< 2.7.33; >= 3.3.0, < 3.3.19; >= 3.4.0, < 3.4.16; >= 3.5.0, < 3.5.14; >= 4.0.0, < 4.0.6), cve.org (>= 4.0.0, < 4.0.6; >= 3.5.0, < 3.5.14; >= 3.4.0, < 3.4.16; >= 3.3.0, < 3.3.19; >= 2.7.0, < 2.7.33), Snyk (< 3.5.14; >= 4.0.0-M1, < 4.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40972"
      },
      "impact_statement": "The target Spring Boot version 3.5.16-tuxcare.8 is NOT affected by CVE-2026-40972. The vulnerability (timing attack on remote DevTools secret comparison) was fixed in the upstream Spring Boot 3.5.16 release before TuxCare onboarded it. The fix commit 4b0862cc00 by Andy Wilkinson (Broadcom) replaced the timing-vulnerable String.equals() comparison with constant-time MessageDigest.isEqual() on byte arrays. The vulnerable pattern (String-based equals comparison) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.6; >= 3.5.0, < 3.5.14; >= 3.4.0, <= 3.4.15; >= 3.3.0, <= 3.3.18; <= 2.7.32), NVD (< 2.7.33; >= 3.3.0, < 3.3.19; >= 3.4.0, < 3.4.16; >= 3.5.0, < 3.5.14; >= 4.0.0, < 4.0.6), cve.org (>= 4.0.0, < 4.0.6; >= 3.5.0, < 3.5.14; >= 3.4.0, < 3.4.16; >= 3.3.0, < 3.3.19; >= 2.7.0, < 2.7.33), Snyk (< 3.5.14; >= 4.0.0-M1, < 4.0.6)."
    }
  ]
}