{
  "@id": "urn:uuid:74019981-70eb-49a8-8298-25bead8b152b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T10:30:48.233833+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@2.1.21.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@2.1.21.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T10:30:48.233833+00:00",
      "status_notes": "Vulnerability CVE-2022-22980 does not affect version 2.1.21.RELEASE-tuxcare.1 of org.springframework.data:spring-data-mongodb. Version 2.1.21.RELEASE is not affected by CVE-2022-22980. The vulnerability exists in ParameterBindingJsonReader.java (introduced in version 2.2.0), which performs string interpolation of parameter placeholders (?0, ?1) inside SpEL expressions. Version 2.1.21 uses a completely different parameter binding architecture (ExpressionEvaluatingParameterBinder) that does not support ?0 syntax inside SpEL expressions and does not perform the vulnerable string interpolation. The attack chain from malicious input to arbitrary code execution is absent because the specific mechanism (replacing ?0 placeholders inside SpEL with .toString() of parameter values) does not exist in this version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22980"
      },
      "impact_statement": "Version 2.1.21.RELEASE is not affected by CVE-2022-22980. The vulnerability exists in ParameterBindingJsonReader.java (introduced in version 2.2.0), which performs string interpolation of parameter placeholders (?0, ?1) inside SpEL expressions. Version 2.1.21 uses a completely different parameter binding architecture (ExpressionEvaluatingParameterBinder) that does not support ?0 syntax inside SpEL expressions and does not perform the vulnerable string interpolation. The attack chain from malicious input to arbitrary code execution is absent because the specific mechanism (replacing ?0 placeholders inside SpEL with .toString() of parameter values) does not exist in this version."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@2.1.21.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@2.1.21.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T10:30:48.233833+00:00",
      "status_notes": "Vulnerability CVE-2026-41696 does not affect version 2.1.21.RELEASE-tuxcare.1 of org.springframework.data:spring-data-mongodb. not_affected \u2014 Version 2.1.21.RELEASE is not affected by CVE-2026-41696. The vulnerable code (ParameterBindingJsonReader.java) and the feature that enables the vulnerability (JSON regex literal syntax with \\Q \\E quoting) do not exist in this version. These were introduced later in version 2.2.0.M2 (February 2019). Version 2.1.21 uses an older parameter binding mechanism (ExpressionEvaluatingParameterBinder) t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41696"
      },
      "impact_statement": "not_affected \u2014 Version 2.1.21.RELEASE is not affected by CVE-2026-41696. The vulnerable code (ParameterBindingJsonReader.java) and the feature that enables the vulnerability (JSON regex literal syntax with \\Q \\E quoting) do not exist in this version. These were introduced later in version 2.2.0.M2 (February 2019). Version 2.1.21 uses an older parameter binding mechanism (ExpressionEvaluatingParameterBinder) t..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@2.1.21.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@2.1.21.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T10:30:48.233833+00:00",
      "status_notes": "Vulnerability CVE-2026-41717 affects version 2.1.21.RELEASE-tuxcare.1 of org.springframework.data:spring-data-mongodb.",
      "vulnerability": {
        "name": "CVE-2026-41717"
      },
      "action_statement": "Vulnerability CVE-2026-41717 affects version 2.1.21.RELEASE-tuxcare.1 of org.springframework.data:spring-data-mongodb."
    }
  ]
}