{
  "@id": "urn:uuid:cb9f0bb3-8d77-4fda-8aa1-3d788be50bac",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 33,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40988 affects version 6.2.7-tuxcare.1 of org.springframework.security:spring-security-saml2-service-provider, and is fixed in 6.2.7-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-40988"
      },
      "action_statement": "Vulnerability CVE-2026-40988 affects version 6.2.7-tuxcare.1 of org.springframework.security:spring-security-saml2-service-provider, and is fixed in 6.2.7-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40993 does not affect version 6.2.7-tuxcare.1 of org.springframework.security:spring-security-saml2-service-provider. Spring Security 6.2.7 is NOT AFFECTED by CVE-2026-40993. The vulnerable class `JdbcAssertingPartyMetadataRepository` and the entire asserting party metadata repository feature do not exist in this version. The feature was introduced in Spring Security 6.4.0 (July 2024), which is newer than the target version 6.2.7. The CVE affects versions 7.0.0 - 7.0.5. The SAML2 module in 6.2.7 has no JDBC-based repositories and no code that deserializes credentials from database columns.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40993"
      },
      "impact_statement": "Spring Security 6.2.7 is NOT AFFECTED by CVE-2026-40993. The vulnerable class `JdbcAssertingPartyMetadataRepository` and the entire asserting party metadata repository feature do not exist in this version. The feature was introduced in Spring Security 6.4.0 (July 2024), which is newer than the target version 6.2.7. The CVE affects versions 7.0.0 - 7.0.5. The SAML2 module in 6.2.7 has no JDBC-based repositories and no code that deserializes credentials from database columns."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-02T16:14:00.134325+00:00",
      "status_notes": "Vulnerability CVE-2026-41003 affects version 6.2.7-tuxcare.1 of org.springframework.security:spring-security-saml2-service-provider, and is fixed in 6.2.7-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-41003"
      },
      "action_statement": "Vulnerability CVE-2026-41003 affects version 6.2.7-tuxcare.1 of org.springframework.security:spring-security-saml2-service-provider, and is fixed in 6.2.7-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41694 affects version 6.2.7-tuxcare.1 of org.springframework.security:spring-security-saml2-service-provider, and is fixed in 6.2.7-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41694"
      },
      "action_statement": "Vulnerability CVE-2026-41694 affects version 6.2.7-tuxcare.1 of org.springframework.security:spring-security-saml2-service-provider, and is fixed in 6.2.7-tuxcare.4."
    }
  ]
}