{
  "@id": "urn:uuid:738bbf73-2ff4-4e8a-bc5b-30845c0fa35a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:02:00.202619+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@4.2.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@4.2.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability CVE-2022-22980 does not affect version 4.2.12-tuxcare.4 of org.springframework.data:spring-data-mongodb. CVE-2022-22980 SpEL injection vulnerability is NOT present in spring-data-mongodb 4.2.12-tuxcare.5. The fix was already included in the upstream version 4.2.12 release (commit 30a417d81, June 2022) before TuxCare onboarded it. The patch replaces vulnerable string concatenation of query parameters into SpEL expressions with typed variable binding, preventing parameter content from being evaluated as code. All fix components are present: SPEL_PARAMETER_BINDING_PATTERN, variable map creation, and evaluateExpression(String, Map) signature.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.1; < 3.3.5), NVD (<= 3.3.4; = 3.4.0), cve.org (>= 3.3.0, <= 3.3.4; = 3.4.0), Snyk (< 3.3.5; >= 3.4.0, < 3.4.1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22980"
      },
      "impact_statement": "CVE-2022-22980 SpEL injection vulnerability is NOT present in spring-data-mongodb 4.2.12-tuxcare.5. The fix was already included in the upstream version 4.2.12 release (commit 30a417d81, June 2022) before TuxCare onboarded it. The patch replaces vulnerable string concatenation of query parameters into SpEL expressions with typed variable binding, preventing parameter content from being evaluated as code. All fix components are present: SPEL_PARAMETER_BINDING_PATTERN, variable map creation, and evaluateExpression(String, Map) signature.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 3.4.0, < 3.4.1; < 3.3.5), NVD (<= 3.3.4; = 3.4.0), cve.org (>= 3.3.0, <= 3.3.4; = 3.4.0), Snyk (< 3.3.5; >= 3.4.0, < 3.4.1)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@4.2.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@4.2.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41696 affects version 4.2.12-tuxcare.4 of org.springframework.data:spring-data-mongodb.",
      "vulnerability": {
        "name": "CVE-2026-41696"
      },
      "action_statement": "Vulnerability CVE-2026-41696 affects version 4.2.12-tuxcare.4 of org.springframework.data:spring-data-mongodb."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb@4.2.12-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb@4.2.12-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41717 is fixed in version 4.2.12-tuxcare.4 of org.springframework.data:spring-data-mongodb.",
      "vulnerability": {
        "name": "CVE-2026-41717"
      }
    }
  ]
}