{
  "@id": "urn:uuid:37ec1188-49b1-4c44-a877-551dd8864e65",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T18:44:00.111620+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2021-22112 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2021-22112"
      },
      "action_statement": "Vulnerability CVE-2021-22112 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "action_statement": "Vulnerability CVE-2022-22978 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:44:00.111620+00:00",
      "status_notes": "Vulnerability CVE-2024-38821 is fixed in version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2024-38821"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2026-22732 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-22732"
      },
      "action_statement": "Vulnerability CVE-2026-22732 affects version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:44:00.111620+00:00",
      "status_notes": "Vulnerability CVE-2026-22747 is fixed in version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-22747"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2026-22754 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.1.2.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4vrc-j85c-598c (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22754"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.1.2.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4vrc-j85c-598c (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2026-41706 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 5.1.2.RELEASE is not affected by CVE-2026-41706. The vulnerability affects CookieRequestCache and CookieServerRequestCache classes that store redirect URLs in browser cookies without validation, enabling open redirect attacks. These classes were introduced in Spring Security 5.4.0 (June 2020), after the 5.1.2.RELEASE version. The target uses HttpSessionRequestCache and WebSessio...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41706"
      },
      "impact_statement": "not_affected \u2014 Spring Security 5.1.2.RELEASE is not affected by CVE-2026-41706. The vulnerability affects CookieRequestCache and CookieServerRequestCache classes that store redirect URLs in browser cookies without validation, enabling open redirect attacks. These classes were introduced in Spring Security 5.4.0 (June 2020), after the 5.1.2.RELEASE version. The target uses HttpSessionRequestCache and WebSessio..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:44:00.111620+00:00",
      "status_notes": "Vulnerability CVE-2026-47838 is fixed in version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-47838"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.2.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.2.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-09T18:42:59.247053+00:00",
      "status_notes": "Vulnerability CVE-2026-47841 does not affect version 5.1.2.RELEASE-tuxcare.2 of org.springframework.security:spring-security-web. Prechecker: No vulnerable code from the fix was found; the vulnerable lines are absent, this version declares none of the classes the fix changes, and their base package is absent. Version 5.1.2.RELEASE is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-47841"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; the vulnerable lines are absent, this version declares none of the classes the fix changes, and their base package is absent. Version 5.1.2.RELEASE is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only)."
    }
  ]
}