{
  "@id": "urn:uuid:bf908b25-eb9b-4f95-8497-2f467da84376",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 18,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T11:40:52.629939+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.5.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.5.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:52.629939+00:00",
      "status_notes": "Vulnerability CVE-2026-22731 does not affect version 3.5.16-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator. Spring Boot 3.5.16-tuxcare.8 is not affected by CVE-2026-22731. The upstream fix (commit 1f2ea4a6db03eb1d666a174a525f2bff658b8296 \"Revisit EndpointRequest matcher for additional paths\") was already included in the Spring Boot 3.5.16 release that TuxCare onboarded. Both reactive and servlet versions of EndpointRequest now use exact path matching for additional health group paths instead of the vulnerable prefix matching pattern, preventing authentication bypass on subpaths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, <= 3.4.13; >= 3.5.0, < 3.5.12; >= 4.0.0-M1, < 4.0.4), NVD (>= 3.4.0, < 3.4.15; >= 3.5.0, < 3.5.12; >= 4.0.0, < 4.0.4), cve.org (>= 4.0, < 4.0.3; >= 3.5, < 3.5.11; >= 3.4, < 3.4.15), Snyk (>= 3.4.0, < 3.5.12; >= 4.0.0-M1, < 4.0.4; >= 3.4.0, < 3.5.12; >= 4.0.0-M1, < 4.0.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22731"
      },
      "impact_statement": "Spring Boot 3.5.16-tuxcare.8 is not affected by CVE-2026-22731. The upstream fix (commit 1f2ea4a6db03eb1d666a174a525f2bff658b8296 \"Revisit EndpointRequest matcher for additional paths\") was already included in the Spring Boot 3.5.16 release that TuxCare onboarded. Both reactive and servlet versions of EndpointRequest now use exact path matching for additional health group paths instead of the vulnerable prefix matching pattern, preventing authentication bypass on subpaths.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, <= 3.4.13; >= 3.5.0, < 3.5.12; >= 4.0.0-M1, < 4.0.4), NVD (>= 3.4.0, < 3.4.15; >= 3.5.0, < 3.5.12; >= 4.0.0, < 4.0.4), cve.org (>= 4.0, < 4.0.3; >= 3.5, < 3.5.11; >= 3.4, < 3.4.15), Snyk (>= 3.4.0, < 3.5.12; >= 4.0.0-M1, < 4.0.4; >= 3.4.0, < 3.5.12; >= 4.0.0-M1, < 4.0.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.5.16-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot-starter-actuator@3.5.16-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:52.629939+00:00",
      "status_notes": "Vulnerability CVE-2026-22733 does not affect version 3.5.16-tuxcare.1 of org.springframework.boot:spring-boot-starter-actuator. CVE-2026-22733 authentication bypass vulnerability is NOT present in Spring Boot 3.5.16-tuxcare.8. The fix was already included in the upstream Spring Boot 3.5.16 release that TuxCare onboarded. Both servlet and reactive CloudFoundry handler mappings register catch-all handlers returning HTTP 403 Forbidden for unmatched paths, preventing delegation to application endpoints. Security configurations properly match BASE_PATH + \"/**\" instead of specific endpoint paths. Fix commit 01fbede2b27237616e215fe0df7c294ae47bdd73 by upstream developer brian.clozel@broadcom.com predates TuxCare's onboarding by 358 commits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0-M1, < 4.0.4; >= 3.5.0, < 3.5.12; >= 3.4.0, <= 3.4.13; >= 3.0.0, <= 3.3.13; <= 2.7.18), NVD (< 2.7.32; >= 3.3.0, < 3.3.18; >= 3.4.0, < 3.4.15; >= 3.5.0, < 3.5.12; >= 4.0.0, < 4.0.4), Snyk (< 3.5.12; >= 4.0.0-M1, < 4.0.4; < 3.5.12; >= 4.0.0-M1, < 4.0.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22733"
      },
      "impact_statement": "CVE-2026-22733 authentication bypass vulnerability is NOT present in Spring Boot 3.5.16-tuxcare.8. The fix was already included in the upstream Spring Boot 3.5.16 release that TuxCare onboarded. Both servlet and reactive CloudFoundry handler mappings register catch-all handlers returning HTTP 403 Forbidden for unmatched paths, preventing delegation to application endpoints. Security configurations properly match BASE_PATH + \"/**\" instead of specific endpoint paths. Fix commit 01fbede2b27237616e215fe0df7c294ae47bdd73 by upstream developer brian.clozel@broadcom.com predates TuxCare's onboarding by 358 commits.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0-M1, < 4.0.4; >= 3.5.0, < 3.5.12; >= 3.4.0, <= 3.4.13; >= 3.0.0, <= 3.3.13; <= 2.7.18), NVD (< 2.7.32; >= 3.3.0, < 3.3.18; >= 3.4.0, < 3.4.15; >= 3.5.0, < 3.5.12; >= 4.0.0, < 4.0.4), Snyk (< 3.5.12; >= 4.0.0-M1, < 4.0.4; < 3.5.12; >= 4.0.0-M1, < 4.0.4)."
    }
  ]
}