{
  "@id": "urn:uuid:507506b5-fe9f-48ae-b89e-61df33fefdbd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.19-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.19-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2020-5413 does not affect version 5.5.19-tuxcare.4 of org.springframework.integration:spring-integration-core. The target Spring Integration 5.5.19 repository is NOT AFFECTED by CVE-2020-5413. The vulnerability fix (kryo.setRegistrationRequired(true)) was already present in the upstream Spring Integration 5.5.19 release that TuxCare onboarded. The fix was authored by Artem Bilan from VMware and shipped in upstream commit 6a02b5abe97fabab6003d51b98dd45ab009a6e05, which predates TuxCare's onboarding commit dd9c641ada. The vulnerable code pattern (Kryo configured with default options allowing unregistered class deserialization) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.3.0, < 4.3.23; >= 5.3.0, < 5.3.2; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8), NVD (>= 4.3.0, <= 4.3.22; >= 5.1.0, <= 5.1.11; >= 5.2.0, <= 5.2.7; >= 5.3.0, <= 5.3.1), cve.org (>= 4.3, < 4.3.23.RELEASE; >= 5.1, < 5.1.12.RELEASE; >= 5.2, < 5.2.8.RELEASE; >= 5.3, < 5.3.2.RELEASE), Snyk (>= 4.3.0, < 4.3.23; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5413"
      },
      "impact_statement": "The target Spring Integration 5.5.19 repository is NOT AFFECTED by CVE-2020-5413. The vulnerability fix (kryo.setRegistrationRequired(true)) was already present in the upstream Spring Integration 5.5.19 release that TuxCare onboarded. The fix was authored by Artem Bilan from VMware and shipped in upstream commit 6a02b5abe97fabab6003d51b98dd45ab009a6e05, which predates TuxCare's onboarding commit dd9c641ada. The vulnerable code pattern (Kryo configured with default options allowing unregistered class deserialization) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.3.0, < 4.3.23; >= 5.3.0, < 5.3.2; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8), NVD (>= 4.3.0, <= 4.3.22; >= 5.1.0, <= 5.1.11; >= 5.2.0, <= 5.2.7; >= 5.3.0, <= 5.3.1), cve.org (>= 4.3, < 4.3.23.RELEASE; >= 5.1, < 5.1.12.RELEASE; >= 5.2, < 5.2.8.RELEASE; >= 5.3, < 5.3.2.RELEASE), Snyk (>= 4.3.0, < 4.3.23; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.2)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.19-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.19-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-27T10:09:59.821256+00:00",
      "status_notes": "Vulnerability CVE-2026-47856 is fixed in version 5.5.19-tuxcare.4 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-47856"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.19-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.19-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-27T10:09:59.821256+00:00",
      "status_notes": "Vulnerability CVE-2026-59292 is fixed in version 5.5.19-tuxcare.4 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59292"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.19-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.19-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-27T10:09:59.821256+00:00",
      "status_notes": "Vulnerability CVE-2026-59322 is fixed in version 5.5.19-tuxcare.4 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59322"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.19-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.19-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-27T10:09:59.821256+00:00",
      "status_notes": "Vulnerability CVE-2026-59324 is fixed in version 5.5.19-tuxcare.4 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59324"
      }
    }
  ]
}