{
  "@id": "urn:uuid:8ba345b9-6e56-4355-9525-3454098a0807",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T14:49:08.571788+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:49:08.571788+00:00",
      "status_notes": "Vulnerability CVE-2019-3774 does not affect version 4.1.1.RELEASE-tuxcare.2 of org.springframework.batch:spring-batch-core. The target Spring Batch 4.1.1.RELEASE is NOT affected by CVE-2019-3774 (XXE vulnerability). The upstream vendor fix that disables DTD support and external entity resolution in XMLInputFactory was already present in the Spring Batch 4.1.1.RELEASE when TuxCare onboarded it. The vulnerable pattern (unconfigured XMLInputFactory allowing external entities) does not exist in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3774"
      },
      "impact_statement": "The target Spring Batch 4.1.1.RELEASE is NOT affected by CVE-2019-3774 (XXE vulnerability). The upstream vendor fix that disables DTD support and external entity resolution in XMLInputFactory was already present in the Spring Batch 4.1.1.RELEASE when TuxCare onboarded it. The vulnerable pattern (unconfigured XMLInputFactory allowing external entities) does not exist in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:49:08.571788+00:00",
      "status_notes": "Vulnerability CVE-2020-5411 affects version 4.1.1.RELEASE-tuxcare.2 of org.springframework.batch:spring-batch-core.",
      "vulnerability": {
        "name": "CVE-2020-5411"
      },
      "action_statement": "Vulnerability CVE-2020-5411 affects version 4.1.1.RELEASE-tuxcare.2 of org.springframework.batch:spring-batch-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:49:08.571788+00:00",
      "status_notes": "Vulnerability CVE-2026-47875 does not affect version 4.1.1.RELEASE-tuxcare.2 of org.springframework.batch:spring-batch-core. not_affected \u2014 Spring Batch 4.1.1.RELEASE is not affected by CVE-2026-47875. The vulnerable code pattern (using Class.forName to load arbitrary classes during JobParameter deserialization) does not exist in this version. Version 4.1.1.RELEASE uses a safe enum-based deserialization approach that only accepts predefined types (STRING, DATE, LONG, DOUBLE). The vulnerable pattern was introduced later in Spring Ba...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-47875"
      },
      "impact_statement": "not_affected \u2014 Spring Batch 4.1.1.RELEASE is not affected by CVE-2026-47875. The vulnerable code pattern (using Class.forName to load arbitrary classes during JobParameter deserialization) does not exist in this version. Version 4.1.1.RELEASE uses a safe enum-based deserialization approach that only accepts predefined types (STRING, DATE, LONG, DOUBLE). The vulnerable pattern was introduced later in Spring Ba..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@4.1.1.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@4.1.1.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-05T14:49:08.571788+00:00",
      "status_notes": "Vulnerability CVE-2026-47878 affects version 4.1.1.RELEASE-tuxcare.2 of org.springframework.batch:spring-batch-core.",
      "vulnerability": {
        "name": "CVE-2026-47878"
      },
      "action_statement": "Vulnerability CVE-2026-47878 affects version 4.1.1.RELEASE-tuxcare.2 of org.springframework.batch:spring-batch-core."
    }
  ]
}