{
  "@id": "urn:uuid:8c4e98d6-42cd-44e8-b189-ba38c08af521",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T08:28:48.020011+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@1.13.23.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@1.13.23.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T08:27:44.304133+00:00",
      "status_notes": "Vulnerability CVE-2018-1259 does not affect version 1.13.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons. Spring Data Commons 1.13.23.RELEASE already contains the fix for CVE-2018-1259: XmlBeamHttpMessageConverter disables DOCTYPE declarations and external entities by default, and the build uses XMLBeam 1.4.15 (fixed upstream in 1.13.12 and 2.0.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1259"
      },
      "impact_statement": "Spring Data Commons 1.13.23.RELEASE already contains the fix for CVE-2018-1259: XmlBeamHttpMessageConverter disables DOCTYPE declarations and external entities by default, and the build uses XMLBeam 1.4.15 (fixed upstream in 1.13.12 and 2.0.7)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@1.13.23.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@1.13.23.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T08:27:44.304133+00:00",
      "status_notes": "Vulnerability CVE-2018-1273 does not affect version 1.13.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons. Spring Data Commons 1.13.23.RELEASE already contains the fix for CVE-2018-1273: MapDataBinder evaluates property paths with a restricted SimpleEvaluationContext instead of StandardEvaluationContext, so request parameters cannot run arbitrary SpEL (fixed upstream in 1.13.11 and 2.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1273"
      },
      "impact_statement": "Spring Data Commons 1.13.23.RELEASE already contains the fix for CVE-2018-1273: MapDataBinder evaluates property paths with a restricted SimpleEvaluationContext instead of StandardEvaluationContext, so request parameters cannot run arbitrary SpEL (fixed upstream in 1.13.11 and 2.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@1.13.23.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@1.13.23.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T08:27:44.304133+00:00",
      "status_notes": "Vulnerability CVE-2018-1274 does not affect version 1.13.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons. Spring Data Commons 1.13.23.RELEASE already contains the fix for CVE-2018-1274: PropertyPath parsing fails with an error once a path exceeds 1000 segments, so crafted property paths cannot exhaust CPU or memory (fixed upstream in 1.13.11 and 2.0.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1274"
      },
      "impact_statement": "Spring Data Commons 1.13.23.RELEASE already contains the fix for CVE-2018-1274: PropertyPath parsing fails with an error once a path exceeds 1000 segments, so crafted property paths cannot exhaust CPU or memory (fixed upstream in 1.13.11 and 2.0.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@1.13.23.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@1.13.23.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T08:27:44.304133+00:00",
      "status_notes": "Vulnerability CVE-2026-41695 does not affect version 1.13.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons. Version 1.13.23.RELEASE is not affected by CVE-2026-41695. The vulnerability requires unbounded cache growth from property path string resolution, but version 1.13.23 has no property path caching mechanism. Property path caching (via PersistentPropertyPathFactory or cached AbstractMappingContext.getPersistentPropertyPath) was introduced in version 2.0.x (commit dfcb9f77a, 2017-07-19). Version 1.13.23 predates this feature and resolves property paths inline without any caching, eliminating the cache pollution attack vector described in the CVE.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41695"
      },
      "impact_statement": "Version 1.13.23.RELEASE is not affected by CVE-2026-41695. The vulnerability requires unbounded cache growth from property path string resolution, but version 1.13.23 has no property path caching mechanism. Property path caching (via PersistentPropertyPathFactory or cached AbstractMappingContext.getPersistentPropertyPath) was introduced in version 2.0.x (commit dfcb9f77a, 2017-07-19). Version 1.13.23 predates this feature and resolves property paths inline without any caching, eliminating the cache pollution attack vector described in the CVE."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@1.13.23.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@1.13.23.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T08:28:48.020011+00:00",
      "status_notes": "Vulnerability CVE-2026-41711 is fixed in version 1.13.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons.",
      "vulnerability": {
        "name": "CVE-2026-41711"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@1.13.23.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@1.13.23.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T08:27:44.304133+00:00",
      "status_notes": "Vulnerability CVE-2026-41716 affects version 1.13.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons.",
      "vulnerability": {
        "name": "CVE-2026-41716"
      },
      "action_statement": "Vulnerability CVE-2026-41716 affects version 1.13.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-commons@1.13.23.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-commons@1.13.23.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T08:27:44.304133+00:00",
      "status_notes": "Vulnerability CVE-2026-41721 affects version 1.13.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons.",
      "vulnerability": {
        "name": "CVE-2026-41721"
      },
      "action_statement": "Vulnerability CVE-2026-41721 affects version 1.13.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-commons."
    }
  ]
}