{
  "@id": "urn:uuid:304fc70d-0503-4f9d-821c-c7c63f493379",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T15:03:00.038623+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:01:56.691994+00:00",
      "status_notes": "Vulnerability CVE-2023-34040 does not affect version 3.2.10-tuxcare.4 of org.springframework.kafka:spring-kafka. not_affected \u2014 The target Spring Kafka 3.2.10-tuxcare.3 is NOT AFFECTED by CVE-2023-34040. The vulnerability (arbitrary Java object deserialization via malicious headers) is not present because the upstream vendor fix was already included in Spring Kafka version 3.2.10 when TuxCare onboarded it. The fix introduces a package-private DeserializationExceptionHeader class and defensive checks that reject foreign ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34040"
      },
      "impact_statement": "not_affected \u2014 The target Spring Kafka 3.2.10-tuxcare.3 is NOT AFFECTED by CVE-2023-34040. The vulnerability (arbitrary Java object deserialization via malicious headers) is not present because the upstream vendor fix was already included in Spring Kafka version 3.2.10 when TuxCare onboarded it. The fix introduces a package-private DeserializationExceptionHeader class and defensive checks that reject foreign ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:01:56.691994+00:00",
      "status_notes": "Vulnerability CVE-2026-41726 affects version 3.2.10-tuxcare.4 of org.springframework.kafka:spring-kafka.",
      "vulnerability": {
        "name": "CVE-2026-41726"
      },
      "action_statement": "Vulnerability CVE-2026-41726 affects version 3.2.10-tuxcare.4 of org.springframework.kafka:spring-kafka."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:00.038623+00:00",
      "status_notes": "Vulnerability CVE-2026-41727 is fixed in version 3.2.10-tuxcare.4 of org.springframework.kafka:spring-kafka.",
      "vulnerability": {
        "name": "CVE-2026-41727"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:01:56.691994+00:00",
      "status_notes": "Vulnerability CVE-2026-41731 affects version 3.2.10-tuxcare.4 of org.springframework.kafka:spring-kafka.",
      "vulnerability": {
        "name": "CVE-2026-41731"
      },
      "action_statement": "Vulnerability CVE-2026-41731 affects version 3.2.10-tuxcare.4 of org.springframework.kafka:spring-kafka."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:00.038623+00:00",
      "status_notes": "Vulnerability CVE-2026-59278 is fixed in version 3.2.10-tuxcare.4 of org.springframework.kafka:spring-kafka.",
      "vulnerability": {
        "name": "CVE-2026-59278"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.kafka/spring-kafka@3.2.10-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-05T15:03:00.038623+00:00",
      "status_notes": "Vulnerability CVE-2026-59317 is fixed in version 3.2.10-tuxcare.4 of org.springframework.kafka:spring-kafka.",
      "vulnerability": {
        "name": "CVE-2026-59317"
      }
    }
  ]
}