{
  "@id": "urn:uuid:436f5337-610a-40a6-984d-0acfc48af5ef",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 37,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:12:34.459172+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.3.10-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.3.10-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T09:12:34.459172+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 6.3.10-tuxcare.5 of org.springframework.security:spring-security-oauth2-client. CVE-2021-22119 affects Spring Security OAuth2 client code that allowed unbounded accumulation of authorization requests in HTTP sessions, leading to DoS. The target Spring Security 6.3.10-tuxcare.21 is NOT AFFECTED because the fix was already present in the upstream Spring Security 6.3.10 release (June 2025) that TuxCare onboarded in April 2026. The vulnerable pattern (storing multiple requests in a Map) is absent; the current code stores only ONE request per session, preventing memory exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "CVE-2021-22119 affects Spring Security OAuth2 client code that allowed unbounded accumulation of authorization requests in HTTP sessions, leading to DoS. The target Spring Security 6.3.10-tuxcare.21 is NOT AFFECTED because the fix was already present in the upstream Spring Security 6.3.10 release (June 2025) that TuxCare onboarded in April 2026. The vulnerable pattern (storing multiple requests in a Map) is absent; the current code stores only ONE request per session, preventing memory exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.3.10-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.3.10-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2022-31690 does not affect version 6.3.10-tuxcare.5 of org.springframework.security:spring-security-oauth2-client. Spring Security 6.3.10 is NOT affected by CVE-2022-31690. The vulnerability was fixed by upstream Spring Security in October/November 2022 (commits 75004587a4 and fde26e003a), well before TuxCare onboarded this version in April 2026. The vulnerable code pattern (automatic scope-filling when Authorization Server returns empty scopes) is completely absent from the target codebase. All token response clients correctly preserve empty scope lists as returned by the server, preventing the privilege escalation attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31690"
      },
      "impact_statement": "Spring Security 6.3.10 is NOT affected by CVE-2022-31690. The vulnerability was fixed by upstream Spring Security in October/November 2022 (commits 75004587a4 and fde26e003a), well before TuxCare onboarded this version in April 2026. The vulnerable code pattern (automatic scope-filling when Authorization Server returns empty scopes) is completely absent from the target codebase. All token response clients correctly preserve empty scope lists as returned by the server, preventing the privilege escalation attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    }
  ]
}