{
  "@id": "urn:uuid:bb6f4b0e-f65b-4459-967f-63f5b0c9a6f4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T10:27:12.057421+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.cloud/spring-cloud-function-parent@3.2.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.cloud/spring-cloud-function-parent@3.2.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T10:27:12.057421+00:00",
      "status_notes": "Vulnerability CVE-2022-22979 does not affect version 3.2.12-tuxcare.1 of org.springframework.cloud:spring-cloud-function-parent. CVE-2022-22979 affects Spring Cloud Function versions prior to 3.2.6 due to a concurrency issue in the Function Catalog component that allows unbounded cache growth leading to denial-of-service. The target repository is version 3.2.12, which already contains the upstream fix (commit 319db4d7 by ozhurakousky@vmware.com, dated 2022-05-30). This fix was included in upstream release 3.2.6 and is present in the target's 3.2.12 release. The vulnerable pattern (unsynchronized function registration during concurrent lookups) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.6), NVD (< 3.2.6), cve.org (< 3.2.6), Snyk (< 3.2.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22979"
      },
      "impact_statement": "CVE-2022-22979 affects Spring Cloud Function versions prior to 3.2.6 due to a concurrency issue in the Function Catalog component that allows unbounded cache growth leading to denial-of-service. The target repository is version 3.2.12, which already contains the upstream fix (commit 319db4d7 by ozhurakousky@vmware.com, dated 2022-05-30). This fix was included in upstream release 3.2.6 and is present in the target's 3.2.12 release. The vulnerable pattern (unsynchronized function registration during concurrent lookups) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.2.6), NVD (< 3.2.6), cve.org (< 3.2.6), Snyk (< 3.2.6)."
    }
  ]
}