{
  "@id": "urn:uuid:8142340c-52e5-4cd9-ab16-2173e05a132f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2021-43466 does not affect version 3.1.2.RELEASE-tuxcare.2 of org.thymeleaf:thymeleaf-spring5. CVE-2021-43466 (Thymeleaf Spring SpEL injection via view name) is NOT present in target version 3.1.2.RELEASE. All security patches (1-8) that fix the vulnerability were already included in the upstream 3.1.2.RELEASE that TuxCare onboarded. The vulnerable code patterns have been removed by the upstream vendor (Daniel Fern\u00e1ndez @ thymeleaf.org) before TuxCare's onboarding commit. Target version is 3.1.2.RELEASE-tuxcare.2, which is newer than the affected version 3.0.12 mentioned in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.13.RELEASE), NVD (= 3.0.12), Snyk (< 3.0.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43466"
      },
      "impact_statement": "CVE-2021-43466 (Thymeleaf Spring SpEL injection via view name) is NOT present in target version 3.1.2.RELEASE. All security patches (1-8) that fix the vulnerability were already included in the upstream 3.1.2.RELEASE that TuxCare onboarded. The vulnerable code patterns have been removed by the upstream vendor (Daniel Fern\u00e1ndez @ thymeleaf.org) before TuxCare's onboarding commit. Target version is 3.1.2.RELEASE-tuxcare.2, which is newer than the affected version 3.0.12 mentioned in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.13.RELEASE), NVD (= 3.0.12), Snyk (< 3.0.13.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40477 affects version 3.1.2.RELEASE-tuxcare.2 of org.thymeleaf:thymeleaf-spring5.",
      "vulnerability": {
        "name": "CVE-2026-40477"
      },
      "action_statement": "Vulnerability CVE-2026-40477 affects version 3.1.2.RELEASE-tuxcare.2 of org.thymeleaf:thymeleaf-spring5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40478 affects version 3.1.2.RELEASE-tuxcare.2 of org.thymeleaf:thymeleaf-spring5.",
      "vulnerability": {
        "name": "CVE-2026-40478"
      },
      "action_statement": "Vulnerability CVE-2026-40478 affects version 3.1.2.RELEASE-tuxcare.2 of org.thymeleaf:thymeleaf-spring5."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41901 is fixed in version 3.1.2.RELEASE-tuxcare.2 of org.thymeleaf:thymeleaf-spring5.",
      "vulnerability": {
        "name": "CVE-2026-41901"
      }
    }
  ]
}