{
  "@id": "urn:uuid:102210a5-abd9-4fe8-b653-7a9f0453d5f6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T18:32:00.321693+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@2.6.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@2.6.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T18:32:00.321693+00:00",
      "status_notes": "Vulnerability CVE-2016-6652 does not affect version 2.6.10-tuxcare.1 of org.springframework.data:spring-data-jpa. not_affected \u2014 CVE-2016-6652 (DATAJPA-965) is NOT present in spring-data-jpa 2.6.10-tuxcare.3. The vulnerability fix was already included in the upstream Spring Data JPA 2.6.10 release before TuxCare onboarding. The target version (2.6.10) is significantly newer than the affected versions (before 1.9.6 and 1.10.x before 1.10.4). The defensive validation code that prevents SQL injection via Sort parameters is ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-6652"
      },
      "impact_statement": "not_affected \u2014 CVE-2016-6652 (DATAJPA-965) is NOT present in spring-data-jpa 2.6.10-tuxcare.3. The vulnerability fix was already included in the upstream Spring Data JPA 2.6.10 release before TuxCare onboarding. The target version (2.6.10) is significantly newer than the affected versions (before 1.9.6 and 1.10.x before 1.10.4). The defensive validation code that prevents SQL injection via Sort parameters is ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@2.6.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@2.6.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T03:14:00.140970+00:00",
      "status_notes": "Vulnerability CVE-2019-3797 does not affect version 2.6.10-tuxcare.1 of org.springframework.data:spring-data-jpa. not_affected \u2014 The target repository (spring-data-jpa version 2.6.10-tuxcare.3) is NOT AFFECTED by CVE-2019-3797. The vulnerability\u2014unescaped wildcard characters (%, _) in LIKE query predicates allowing retrieval of more database records than authorized\u2014was fixed by upstream Spring Data JPA before TuxCare onboarded version 2.6.10. The fix (DATAJPA-1519, DATAJPA-1522, DATAJPA-1534) introduced the EscapeCharact...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3797"
      },
      "impact_statement": "not_affected \u2014 The target repository (spring-data-jpa version 2.6.10-tuxcare.3) is NOT AFFECTED by CVE-2019-3797. The vulnerability\u2014unescaped wildcard characters (%, _) in LIKE query predicates allowing retrieval of more database records than authorized\u2014was fixed by upstream Spring Data JPA before TuxCare onboarded version 2.6.10. The fix (DATAJPA-1519, DATAJPA-1522, DATAJPA-1534) introduced the EscapeCharact..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@2.6.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@2.6.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-02T02:37:37.853216+00:00",
      "status_notes": "Vulnerability CVE-2019-3802 does not affect version 2.6.10-tuxcare.1 of org.springframework.data:spring-data-jpa. not_affected \u2014 The target repository (spring-data-jpa 2.6.10-tuxcare.3) is not affected by CVE-2019-3802. The vulnerability involved unescaped SQL wildcards in Query by Example LIKE clauses when using STARTING, ENDING, or CONTAINING string matchers, allowing attackers to inject wildcards and retrieve more results than intended. The complete upstream fix (DATAJPA-1534 and DATAJPA-1522) is present in the target...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3802"
      },
      "impact_statement": "not_affected \u2014 The target repository (spring-data-jpa 2.6.10-tuxcare.3) is not affected by CVE-2019-3802. The vulnerability involved unescaped SQL wildcards in Query by Example LIKE clauses when using STARTING, ENDING, or CONTAINING string matchers, allowing attackers to inject wildcards and retrieve more results than intended. The complete upstream fix (DATAJPA-1534 and DATAJPA-1522) is present in the target..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-jpa@2.6.10-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-jpa@2.6.10-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:40:55.741562+00:00",
      "status_notes": "Vulnerability CVE-2026-47834 affects version 2.6.10-tuxcare.1 of org.springframework.data:spring-data-jpa.",
      "vulnerability": {
        "name": "CVE-2026-47834"
      },
      "action_statement": "Vulnerability CVE-2026-47834 affects version 2.6.10-tuxcare.1 of org.springframework.data:spring-data-jpa."
    }
  ]
}