{
  "@id": "urn:uuid:8e0a7957-f394-400c-8125-08bbedda5bd6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-23T11:02:36.632099+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb-parent@4.5.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb-parent@4.5.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-21T10:36:00.122180+00:00",
      "status_notes": "Vulnerability CVE-2026-41696 does not affect version 4.5.12-tuxcare.1 of org.springframework.data:spring-data-mongodb-parent. CVE-2026-41696 is already fixed in spring-data-mongodb 4.5.12. The vulnerability involved insufficient escaping of user-supplied parameters in regex patterns using \\Q..\\E quoting, allowing attackers to inject arbitrary regex patterns. The fix (commit 24d5afc0c, authored by upstream vendor Christoph Strobl) properly escapes \\E sequences via the escapeIfQuoted() method",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41696"
      },
      "impact_statement": "CVE-2026-41696 is already fixed in spring-data-mongodb 4.5.12. The vulnerability involved insufficient escaping of user-supplied parameters in regex patterns using \\Q..\\E quoting, allowing attackers to inject arbitrary regex patterns. The fix (commit 24d5afc0c, authored by upstream vendor Christoph Strobl) properly escapes \\E sequences via the escapeIfQuoted() method"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.data/spring-data-mongodb-parent@4.5.12-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.data/spring-data-mongodb-parent@4.5.12-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T11:02:36.632099+00:00",
      "status_notes": "Vulnerability CVE-2026-41717 does not affect version 4.5.12-tuxcare.1 of org.springframework.data:spring-data-mongodb-parent. Spring Data MongoDB 4.5.12 is not vulnerable as it is equal to upstream fix version - 4.5.12",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41717"
      },
      "impact_statement": "Spring Data MongoDB 4.5.12 is not vulnerable as it is equal to upstream fix version - 4.5.12"
    }
  ]
}