{
  "@id": "urn:uuid:84bd43f4-999b-429c-83eb-60e6f86191d0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 15,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:13:00.045658+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.2.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.2.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T16:42:00.216861+00:00",
      "status_notes": "Vulnerability CVE-2018-1196 does not affect version 3.2.12-tuxcare.4 of org.springframework.boot:spring-boot. not_affected \u2014 CVE-2018-1196 affects Spring Boot 1.5.9 and earlier, and 2.0.0.M1 through 2.0.0.M7 (released in early 2018). The target version 3.2.12 is much newer and already contains the upstream fix applied in January 2018. The vulnerable code pattern (unconditional chown operations on pid/log files that could be symlinks) is not present. The launch.script at lines 178-189 includes defensive checks that on...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1196"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1196 affects Spring Boot 1.5.9 and earlier, and 2.0.0.M1 through 2.0.0.M7 (released in early 2018). The target version 3.2.12 is much newer and already contains the upstream fix applied in January 2018. The vulnerable code pattern (unconditional chown operations on pid/log files that could be symlinks) is not present. The launch.script at lines 178-189 includes defensive checks that on..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.2.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.2.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2022-27772 does not affect version 3.2.12-tuxcare.4 of org.springframework.boot:spring-boot. CVE-2022-27772 is NOT present in Spring Boot 3.2.12. The vulnerable temporary directory creation pattern (createTempFile \u2192 delete \u2192 mkdir race condition) was fixed by upstream Spring developers in commits 667ccdae84 and 44eb8c39d2, which were already included in the Spring Boot 3.2.12 release before TuxCare onboarded it. All affected files now use the secure Files.createTempDirectory() API that atomically creates directories with proper permissions, eliminating the race window. Exhaustive searches confirmed no instances of the vulnerable pattern exist in production code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-27772"
      },
      "impact_statement": "CVE-2022-27772 is NOT present in Spring Boot 3.2.12. The vulnerable temporary directory creation pattern (createTempFile \u2192 delete \u2192 mkdir race condition) was fixed by upstream Spring developers in commits 667ccdae84 and 44eb8c39d2, which were already included in the Spring Boot 3.2.12 release before TuxCare onboarded it. All affected files now use the secure Files.createTempDirectory() API that atomically creates directories with proper permissions, eliminating the race window. Exhaustive searches confirmed no instances of the vulnerable pattern exist in production code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.2.11.RELEASE), NVD (< 2.2.11), Snyk (< 2.2.11.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.2.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.2.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22235 is fixed in version 3.2.12-tuxcare.4 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2025-22235"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.2.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.2.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-28T18:36:42.887038+00:00",
      "status_notes": "Vulnerability CVE-2026-40973 affects version 3.2.12-tuxcare.4 of org.springframework.boot:spring-boot.",
      "vulnerability": {
        "name": "CVE-2026-40973"
      },
      "action_statement": "Vulnerability CVE-2026-40973 affects version 3.2.12-tuxcare.4 of org.springframework.boot:spring-boot."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.2.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.2.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-26T12:55:53.554317+00:00",
      "status_notes": "Vulnerability CVE-2026-40975 affects version 3.2.12-tuxcare.4 of org.springframework.boot:spring-boot, and is fixed in 3.2.12-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-40975"
      },
      "action_statement": "Vulnerability CVE-2026-40975 affects version 3.2.12-tuxcare.4 of org.springframework.boot:spring-boot, and is fixed in 3.2.12-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.2.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.2.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-10T04:13:00.045658+00:00",
      "status_notes": "Vulnerability CVE-2026-40976 does not affect version 3.2.12-tuxcare.4 of org.springframework.boot:spring-boot. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because omitting the separate spring-boot-health artifact does not remove HealthEndpoint. spring-boot-project/spring-boot-actuator-autoconfigure/build.gradle:20 declares actuator as an API dependency, and actuator contains HealthEndpoint at spring-boot-project/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/health/HealthEndpoint.java:42.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-40976"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because omitting the separate spring-boot-health artifact does not remove HealthEndpoint. spring-boot-project/spring-boot-actuator-autoconfigure/build.gradle:20 declares actuator as an API dependency, and actuator contains HealthEndpoint at spring-boot-project/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/health/HealthEndpoint.java:42."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.boot/spring-boot@3.2.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.boot/spring-boot@3.2.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:59:00.079375+00:00",
      "status_notes": "Vulnerability CVE-2026-40977 affects version 3.2.12-tuxcare.4 of org.springframework.boot:spring-boot, and is fixed in 3.2.12-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-40977"
      },
      "action_statement": "Vulnerability CVE-2026-40977 affects version 3.2.12-tuxcare.4 of org.springframework.boot:spring-boot, and is fixed in 3.2.12-tuxcare.6."
    }
  ]
}