{
  "@id": "urn:uuid:e9d57779-4198-403b-9cd3-a1bf012c70ba",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 26,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:43:21.485909+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-bom@6.2.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-bom@6.2.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:43:21.485909+00:00",
      "status_notes": "Vulnerability CVE-2021-22112 does not affect version 6.2.2-tuxcare.1 of org.springframework.security:spring-security-bom. CVE-2021-22112 affects Spring Security versions 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8, 5.2.x prior to 5.2.9, and older versions. The target repository is Spring Security 6.2.2, which already contains the upstream fix (commit 3116369f027) that was introduced in version 6.0.0. The vulnerable pattern (failure to save SecurityContext when changed multiple times in a request) is not present. All fix components are in place: the isSaveContextInvoked tracking field, the modified contextChanged() method, and removal of the save-once guard. This is an upstream fix that shipped with the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22112"
      },
      "impact_statement": "CVE-2021-22112 affects Spring Security versions 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8, 5.2.x prior to 5.2.9, and older versions. The target repository is Spring Security 6.2.2, which already contains the upstream fix (commit 3116369f027) that was introduced in version 6.0.0. The vulnerable pattern (failure to save SecurityContext when changed multiple times in a request) is not present. All fix components are in place: the isSaveContextInvoked tracking field, the modified contextChanged() method, and removal of the save-once guard. This is an upstream fix that shipped with the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE)."
    }
  ]
}