{ "@id": "urn:uuid:9dc9302b-8e68-49a6-85d3-45b5b9ad1468", "role": "Document Creator", "author": "https://tuxcare.com", "version": 31, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T15:50:03.446715+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@4.2.20.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@4.2.20.RELEASE-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2007-1651 does not affect version 4.2.20.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web. Version 4.2.20.RELEASE is not vulnerable. Summary: The target repository is NOT VULNERABLE to CVE-2007-1651. The security fix has already been applied.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2007-1651" }, "impact_statement": "Version 4.2.20.RELEASE is not vulnerable. Summary: The target repository is NOT VULNERABLE to CVE-2007-1651. The security fix has already been applied." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@4.2.20.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@4.2.20.RELEASE-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2007-1652 does not affect version 4.2.20.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web. Version 4.2.20.RELEASE is not vulnerable. Summary: The target repository is NOT VULNERABLE to CVE-2007-1652. The security fix has already been applied. The code contains the necessary null check for DiscoveryInformation that prevents replay attacks and session-based exploitation.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2007-1652" }, "impact_statement": "Version 4.2.20.RELEASE is not vulnerable. Summary: The target repository is NOT VULNERABLE to CVE-2007-1652. The security fix has already been applied. The code contains the necessary null check for DiscoveryInformation that prevents replay attacks and session-based exploitation." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@4.2.20.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@4.2.20.RELEASE-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-22112 is fixed in version 4.2.20.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2021-22112" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@4.2.20.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@4.2.20.RELEASE-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2022-22978 is fixed in version 4.2.20.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2022-22978" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@4.2.20.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@4.2.20.RELEASE-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38821 does not affect version 4.2.20.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web. 4.2.20.RELEASE is not affected. The CVE targets the WebFlux stack (org.springframework.security.web.server); WebFlux was added in Spring Security 5.2, so 4.2.x has no WebFlux code. This branch only has the servlet stack (FilterChainProxy, HttpFirewall, etc.). The vulnerable path (WebFlux + static resources + non-permitAll) cannot occur here. Advisories may list 4.2.20 as \"affected\" by version range, but the vulnerable code is not present, so the release is not exploitable for this CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-38821" }, "impact_statement": "4.2.20.RELEASE is not affected. The CVE targets the WebFlux stack (org.springframework.security.web.server); WebFlux was added in Spring Security 5.2, so 4.2.x has no WebFlux code. This branch only has the servlet stack (FilterChainProxy, HttpFirewall, etc.). The vulnerable path (WebFlux + static resources + non-permitAll) cannot occur here. Advisories may list 4.2.20 as \"affected\" by version range, but the vulnerable code is not present, so the release is not exploitable for this CVE." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@4.2.20.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@4.2.20.RELEASE-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22732 is fixed in version 4.2.20.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2026-22732" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@4.2.20.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@4.2.20.RELEASE-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22747 affects version 4.2.20.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web, and is fixed in 4.2.20.RELEASE-tuxcare.7.", "vulnerability": { "name": "CVE-2026-22747" }, "action_statement": "Vulnerability CVE-2026-22747 affects version 4.2.20.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web, and is fixed in 4.2.20.RELEASE-tuxcare.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@4.2.20.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@4.2.20.RELEASE-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22754 does not affect version 4.2.20.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web. According to security advisories CVE-2026-22754 does not affect Spring-Security versions earlier than 7.0.0. This is supported by manual code inspection and proof-of-concept tests ported from the upstream fix commit. CVE-2026-22754 is an access-control bypass caused by PathPatternRequestMatcherFactoryBean.afterPropertiesSet() calling this.builder.basePath(this.basePath) and discarding the return value \u2014 PathPatternRequestMatcher.Builder is immutable/copy-on-modify, so the configured basePath was silently dropped and protected URLs (e.g., /spring/path) were left unmatched by the security filter chain. The vulnerability requires two pieces of infrastructure introduced in Spring Security 7.0.0: 1. The PathPatternRequestMatcher.Builder API (added in upstream commit 3e53cc2c4a, \"Use PathPatternRequestMatcher in config\"). 2. The PathPatternRequestMatcherFactoryBean class itself \u2014 the exact file patched by upstream commit 53bcf0d1 (the CVE fix). Neither piece exists in version 4.2.20.RELEASE. The upstream POC tests (RegexMatcher, CiRegexMatcher + AuthorizationManager variants) were ported verbatim and pass.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22754" }, "impact_statement": "According to security advisories CVE-2026-22754 does not affect Spring-Security versions earlier than 7.0.0. This is supported by manual code inspection and proof-of-concept tests ported from the upstream fix commit. CVE-2026-22754 is an access-control bypass caused by PathPatternRequestMatcherFactoryBean.afterPropertiesSet() calling this.builder.basePath(this.basePath) and discarding the return value \u2014 PathPatternRequestMatcher.Builder is immutable/copy-on-modify, so the configured basePath was silently dropped and protected URLs (e.g., /spring/path) were left unmatched by the security filter chain. The vulnerability requires two pieces of infrastructure introduced in Spring Security 7.0.0: 1. The PathPatternRequestMatcher.Builder API (added in upstream commit 3e53cc2c4a, \"Use PathPatternRequestMatcher in config\"). 2. The PathPatternRequestMatcherFactoryBean class itself \u2014 the exact file patched by upstream commit 53bcf0d1 (the CVE fix). Neither piece exists in version 4.2.20.RELEASE. The upstream POC tests (RegexMatcher, CiRegexMatcher + AuthorizationManager variants) were ported verbatim and pass." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@4.2.20.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@4.2.20.RELEASE-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41706 does not affect version 4.2.20.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 4.2.20.RELEASE-tuxcare.4 is NOT affected by CVE-2026-41706. The vulnerable classes (CookieRequestCache and CookieServerRequestCache) do not exist in this version. These classes were first introduced in Spring Security 5.4.0 (June 2020), while version 4.2.20 predates this feature. The CVE affects versions 5.7.0+ through 7.0.5, and version 4.2.20 is outside this range.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41706" }, "impact_statement": "not_affected \u2014 Spring Security 4.2.20.RELEASE-tuxcare.4 is NOT affected by CVE-2026-41706. The vulnerable classes (CookieRequestCache and CookieServerRequestCache) do not exist in this version. These classes were first introduced in Spring Security 5.4.0 (June 2020), while version 4.2.20 predates this feature. The CVE affects versions 5.7.0+ through 7.0.5, and version 4.2.20 is outside this range." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@4.2.20.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@4.2.20.RELEASE-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47838 affects version 4.2.20.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web, and is fixed in 4.2.20.RELEASE-tuxcare.7.", "vulnerability": { "name": "CVE-2026-47838" }, "action_statement": "Vulnerability CVE-2026-47838 affects version 4.2.20.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web, and is fixed in 4.2.20.RELEASE-tuxcare.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@4.2.20.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@4.2.20.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-30T12:30:16.743106+00:00", "status_notes": "Vulnerability CVE-2026-47841 does not affect version 4.2.20.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 4.2.20.RELEASE contains no WebAuthn code, so it is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47841" }, "impact_statement": "CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 4.2.20.RELEASE contains no WebAuthn code, so it is not affected." } ] }