{
  "@id": "urn:uuid:d38d5292-e284-4652-8cf6-1fbc7ebddd4a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T13:59:40.667316+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@1.10.23.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@1.10.23.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T13:59:40.667316+00:00",
      "status_notes": "Vulnerability CVE-2022-22980 does not affect version 1.10.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-mongodb. Version 1.10.23.RELEASE is not affected by CVE-2022-22980. The vulnerable feature\u2014parameter placeholders (?0) inside SpEL expressions (?#{...?0...}) with string concatenation binding\u2014does not exist in this version. Version 1.10.23 uses a different architecture (ExpressionEvaluatingParameterBinder) that only supports ?#{[0]} notation where parameters are passed as values via the evaluation context, preventing SpEL injection. The vulnerable code path was introduced in later versions (3.3+/4.0+) with ParameterBindingJsonReader.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22980"
      },
      "impact_statement": "Version 1.10.23.RELEASE is not affected by CVE-2022-22980. The vulnerable feature\u2014parameter placeholders (?0) inside SpEL expressions (?#{...?0...}) with string concatenation binding\u2014does not exist in this version. Version 1.10.23 uses a different architecture (ExpressionEvaluatingParameterBinder) that only supports ?#{[0]} notation where parameters are passed as values via the evaluation context, preventing SpEL injection. The vulnerable code path was introduced in later versions (3.3+/4.0+) with ParameterBindingJsonReader."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@1.10.23.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@1.10.23.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T13:59:40.667316+00:00",
      "status_notes": "Vulnerability CVE-2026-41696 does not affect version 1.10.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-mongodb. not_affected \u2014 Version 1.10.23.RELEASE is not affected by CVE-2026-41696. The vulnerable component (ParameterBindingJsonReader class) does not exist in this version. ParameterBindingJsonReader was introduced in Spring Data MongoDB 2.2.0.M2 (February 2019) via DATAMONGO-2199, approximately 2 years after the 1.10.x release line. Version 1.10.23 uses a completely different architecture (ExpressionEvaluatingParam...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41696"
      },
      "impact_statement": "not_affected \u2014 Version 1.10.23.RELEASE is not affected by CVE-2026-41696. The vulnerable component (ParameterBindingJsonReader class) does not exist in this version. ParameterBindingJsonReader was introduced in Spring Data MongoDB 2.2.0.M2 (February 2019) via DATAMONGO-2199, approximately 2 years after the 1.10.x release line. Version 1.10.23 uses a completely different architecture (ExpressionEvaluatingParam..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@1.10.23.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@1.10.23.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T13:59:40.667316+00:00",
      "status_notes": "Vulnerability CVE-2026-41717 does not affect version 1.10.23.RELEASE-tuxcare.1 of org.springframework.data:spring-data-mongodb. Version 1.10.23.RELEASE is not affected by CVE-2026-41717. The vulnerable code paths (ParameterBindingJsonReader and ParameterBindingDocumentCodec classes) that were patched in later versions do not exist in this version. The vulnerability was introduced after 1.10.23 in the 2.x or 3.x series. This version uses a different parameter binding mechanism (ExpressionEvaluatingParameterBinder) that serializes user input via MongoDB driver's JSON.serialize() without the double-decoding or escape sequence handling flaws that were fixed in later versions.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41717"
      },
      "impact_statement": "Version 1.10.23.RELEASE is not affected by CVE-2026-41717. The vulnerable code paths (ParameterBindingJsonReader and ParameterBindingDocumentCodec classes) that were patched in later versions do not exist in this version. The vulnerability was introduced after 1.10.23 in the 2.x or 3.x series. This version uses a different parameter binding mechanism (ExpressionEvaluatingParameterBinder) that serializes user input via MongoDB driver's JSON.serialize() without the double-decoding or escape sequence handling flaws that were fixed in later versions."
    }
  ]
}