{
  "@id": "urn:uuid:0548c768-e980-4629-8ac5-2a470f52c6e4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T10:31:00.177800+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-function-context@3.2.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-function-context@3.2.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T10:27:12.057421+00:00",
      "status_notes": "Vulnerability CVE-2022-22963 does not affect version 3.2.12-tuxcare.1 of org.springframework.cloud:spring-cloud-function-context. CVE-2022-22963 is not present in Spring Cloud Function 3.2.12. The vulnerability affected versions 3.1.6, 3.2.2 and older, but version 3.2.12 already contains the upstream vendor fix. The target code uses SimpleEvaluationContext (restricted, safe) for header-provided routing expressions at line 231, blocking SpEL injection attempts like T(java.lang.Runtime). This fix was introduced in upstream commit 19dc7ca7d by ozhurakousky@vmware.com on 2022-03-24 and was included in the 3.2.12 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.2.0, < 3.2.3; < 3.1.7), NVD (<= 3.1.6; >= 3.2.0, <= 3.2.2), cve.org (= 3.1.6; = 3.2.2), Snyk (< 3.1.7; >= 3.2.0, < 3.2.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22963"
      },
      "impact_statement": "CVE-2022-22963 is not present in Spring Cloud Function 3.2.12. The vulnerability affected versions 3.1.6, 3.2.2 and older, but version 3.2.12 already contains the upstream vendor fix. The target code uses SimpleEvaluationContext (restricted, safe) for header-provided routing expressions at line 231, blocking SpEL injection attempts like T(java.lang.Runtime). This fix was introduced in upstream commit 19dc7ca7d by ozhurakousky@vmware.com on 2022-03-24 and was included in the 3.2.12 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.2.0, < 3.2.3; < 3.1.7), NVD (<= 3.1.6; >= 3.2.0, <= 3.2.2), cve.org (= 3.1.6; = 3.2.2), Snyk (< 3.1.7; >= 3.2.0, < 3.2.3)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-function-context@3.2.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-function-context@3.2.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T10:31:00.177800+00:00",
      "status_notes": "Vulnerability CVE-2026-40989 is fixed in version 3.2.12-tuxcare.1 of org.springframework.cloud:spring-cloud-function-context.",
      "vulnerability": {
        "name": "CVE-2026-40989"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-function-context@3.2.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-function-context@3.2.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T10:27:12.057421+00:00",
      "status_notes": "Vulnerability CVE-2026-40990 affects version 3.2.12-tuxcare.1 of org.springframework.cloud:spring-cloud-function-context.",
      "vulnerability": {
        "name": "CVE-2026-40990"
      },
      "action_statement": "Vulnerability CVE-2026-40990 affects version 3.2.12-tuxcare.1 of org.springframework.cloud:spring-cloud-function-context."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-function-context@3.2.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-function-context@3.2.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T10:27:12.057421+00:00",
      "status_notes": "Vulnerability CVE-2026-59291 does not affect version 3.2.12-tuxcare.1 of org.springframework.cloud:spring-cloud-function-context. not_affected \u2014 Version 3.2.12 is not affected by CVE-2026-59291. The vulnerable functionality - reading arbitrary class names from the Content-Type header's type parameter and loading them via Thread.currentThread().getContextClassLoader().loadClass() - was introduced in commit 6969ec97 (June 1, 2023) on the 4.x development branch. Version 3.2.12 predates this feature and contains a simpler JsonMessageConvert...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59291"
      },
      "impact_statement": "not_affected \u2014 Version 3.2.12 is not affected by CVE-2026-59291. The vulnerable functionality - reading arbitrary class names from the Content-Type header's type parameter and loading them via Thread.currentThread().getContextClassLoader().loadClass() - was introduced in commit 6969ec97 (June 1, 2023) on the 4.x development branch. Version 3.2.12 predates this feature and contains a simpler JsonMessageConvert..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-function-context@3.2.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-function-context@3.2.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T10:31:00.177800+00:00",
      "status_notes": "Vulnerability CVE-2026-59299 is fixed in version 3.2.12-tuxcare.1 of org.springframework.cloud:spring-cloud-function-context.",
      "vulnerability": {
        "name": "CVE-2026-59299"
      }
    }
  ]
}