{
  "@id": "urn:uuid:b21bc0cc-9b98-4443-b6db-525001322b75",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.1.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.1.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2020-5413 does not affect version 6.1.5-tuxcare.4 of org.springframework.integration:spring-integration-core. CVE-2020-5413 fix is already present in the target. The upstream Spring Integration project added `kryo.setRegistrationRequired(true)` in commit 6a02b5abe9 (July 2020) to block deserialization of unregistered classes. This fix was included in Spring Integration 6.1.5 upstream release, which TuxCare subsequently onboarded. The vulnerable pattern (Kryo without registration requirement) does not exist in the target at HEAD (ff37b6ed37).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.3.0, < 4.3.23; >= 5.3.0, < 5.3.2; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8), NVD (>= 4.3.0, <= 4.3.22; >= 5.1.0, <= 5.1.11; >= 5.2.0, <= 5.2.7; >= 5.3.0, <= 5.3.1), cve.org (>= 4.3, < 4.3.23.RELEASE; >= 5.1, < 5.1.12.RELEASE; >= 5.2, < 5.2.8.RELEASE; >= 5.3, < 5.3.2.RELEASE), Snyk (>= 4.3.0, < 4.3.23; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5413"
      },
      "impact_statement": "CVE-2020-5413 fix is already present in the target. The upstream Spring Integration project added `kryo.setRegistrationRequired(true)` in commit 6a02b5abe9 (July 2020) to block deserialization of unregistered classes. This fix was included in Spring Integration 6.1.5 upstream release, which TuxCare subsequently onboarded. The vulnerable pattern (Kryo without registration requirement) does not exist in the target at HEAD (ff37b6ed37).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.3.0, < 4.3.23; >= 5.3.0, < 5.3.2; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8), NVD (>= 4.3.0, <= 4.3.22; >= 5.1.0, <= 5.1.11; >= 5.2.0, <= 5.2.7; >= 5.3.0, <= 5.3.1), cve.org (>= 4.3, < 4.3.23.RELEASE; >= 5.1, < 5.1.12.RELEASE; >= 5.2, < 5.2.8.RELEASE; >= 5.3, < 5.3.2.RELEASE), Snyk (>= 4.3.0, < 4.3.23; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.2)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.1.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.1.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-27T12:02:20.425359+00:00",
      "status_notes": "Vulnerability CVE-2026-47856 is fixed in version 6.1.5-tuxcare.4 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-47856"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.1.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.1.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-27T12:02:20.425359+00:00",
      "status_notes": "Vulnerability CVE-2026-59292 is fixed in version 6.1.5-tuxcare.4 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59292"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.1.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.1.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-27T12:02:20.425359+00:00",
      "status_notes": "Vulnerability CVE-2026-59322 is fixed in version 6.1.5-tuxcare.4 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59322"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.1.5-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.1.5-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-27T12:02:20.425359+00:00",
      "status_notes": "Vulnerability CVE-2026-59324 is fixed in version 6.1.5-tuxcare.4 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59324"
      }
    }
  ]
}