{
  "@id": "urn:uuid:883c94c8-fa4d-4608-918b-08f3765700ef",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:24:21.599166+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-crypto@6.4.13-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-crypto@6.4.13-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-06T17:24:21.599166+00:00",
      "status_notes": "Vulnerability CVE-2025-22228 does not affect version 6.4.13-tuxcare.8 of org.springframework.security:spring-security-crypto. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 6.4.4, and version 6.4.13 is a later release of the same line. Advisories: GitHub GHSA-mg83-c7gq-rv5c (fixed in 6.4.4), CVE record (fixed in 6.4.4), Snyk (fixed in 6.4.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22228"
      },
      "impact_statement": "Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 6.4.4, and version 6.4.13 is a later release of the same line. Advisories: GitHub GHSA-mg83-c7gq-rv5c (fixed in 6.4.4), CVE record (fixed in 6.4.4), Snyk (fixed in 6.4.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-crypto@6.4.13-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-crypto@6.4.13-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-05T16:19:58.820288+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 does not affect version 6.4.13-tuxcare.8 of org.springframework.security:spring-security-crypto. not_affected \u2014 CVE-2025-22234 is NOT present in Spring Security 6.4.13. The vulnerability (broken timing attack mitigation caused by unconditional BCrypt 72-byte password limit enforcement) was fixed in upstream commit c1aa99fdd2 which shipped with Spring Security 6.4.13. The fix modified BCrypt to only enforce the 72-byte limit when encoding new passwords (!for_check), allowing password matching to proceed n...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-22234 is NOT present in Spring Security 6.4.13. The vulnerability (broken timing attack mitigation caused by unconditional BCrypt 72-byte password limit enforcement) was fixed in upstream commit c1aa99fdd2 which shipped with Spring Security 6.4.13. The fix modified BCrypt to only enforce the 72-byte limit when encoding new passwords (!for_check), allowing password matching to proceed n..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-crypto@6.4.13-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-crypto@6.4.13-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-05T16:19:58.820288+00:00",
      "status_notes": "Vulnerability CVE-2026-47842 is fixed in version 6.4.13-tuxcare.8 of org.springframework.security:spring-security-crypto.",
      "vulnerability": {
        "name": "CVE-2026-47842"
      }
    }
  ]
}