{ "@id": "urn:uuid:42822fd1-02bb-4d93-b73f-077a37ae0c58", "role": "Document Creator", "author": "https://tuxcare.com", "version": 33, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-03T12:43:21.485909+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.11-tuxcare.8", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.11-tuxcare.8" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2007-1651 is a false positive for org.springframework.security:spring-security-web 5.7.11-tuxcare.8. direct vulnerability is in OpenID project", "vulnerability": { "name": "CVE-2007-1651" }, "impact_statement": "direct vulnerability is in OpenID project" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.11-tuxcare.8", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.11-tuxcare.8" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-web 5.7.11-tuxcare.8. direct vulnerability is in OpenID project", "vulnerability": { "name": "CVE-2007-1652" }, "impact_statement": "direct vulnerability is in OpenID project" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.11-tuxcare.8", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.11-tuxcare.8" } } ], "timestamp": "2026-11-03T12:43:21.485909+00:00", "status_notes": "Vulnerability CVE-2021-22112 does not affect version 5.7.11-tuxcare.8 of org.springframework.security:spring-security-web. CVE-2021-22112 is NOT present in Spring Security 5.7.11. The vulnerability involved HttpSessionSecurityContextRepository failing to save the SecurityContext when it was changed multiple times in a single request. The upstream fix (commit c72a6fac04) introduced a `isSaveContextInvoked` flag to track whether saveContext() has been called, ensuring subsequent context changes are properly detected and saved. This fix was already included in the upstream Spring Security 5.7.11 release before TuxCare onboarded the project, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-22112" }, "impact_statement": "CVE-2021-22112 is NOT present in Spring Security 5.7.11. The vulnerability involved HttpSessionSecurityContextRepository failing to save the SecurityContext when it was changed multiple times in a single request. The upstream fix (commit c72a6fac04) introduced a `isSaveContextInvoked` flag to track whether saveContext() has been called, ensuring subsequent context changes are properly detected and saved. This fix was already included in the upstream Spring Security 5.7.11 release before TuxCare onboarded the project, making the target not affected by this vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.11-tuxcare.8", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.11-tuxcare.8" } } ], "timestamp": "2026-11-03T12:16:16.415526+00:00", "status_notes": "Vulnerability CVE-2022-22978 does not affect version 5.7.11-tuxcare.8 of org.springframework.security:spring-security-web. Spring Security 5.7.11 is not affected by CVE-2022-22978. The vulnerability allowed authorization bypass via newline characters in request paths exploiting the regex `.` metacharacter's inability to match newlines. The fix (adding Pattern.DOTALL flag to RegexRequestMatcher) was included in the upstream Spring Security 5.7.11 release (September 2023), which shipped well after the fix commit (May 2022). The target contains the corrected code where DEFAULT = Pattern.DOTALL, ensuring regex patterns like `/admin.*` correctly match paths containing newlines, preventing the bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22978" }, "impact_statement": "Spring Security 5.7.11 is not affected by CVE-2022-22978. The vulnerability allowed authorization bypass via newline characters in request paths exploiting the regex `.` metacharacter's inability to match newlines. The fix (adding Pattern.DOTALL flag to RegexRequestMatcher) was included in the upstream Spring Security 5.7.11 release (September 2023), which shipped well after the fix commit (May 2022). The target contains the corrected code where DEFAULT = Pattern.DOTALL, ensuring regex patterns like `/admin.*` correctly match paths containing newlines, preventing the bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.11-tuxcare.8", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.11-tuxcare.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38821 is fixed in version 5.7.11-tuxcare.8 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2024-38821" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.11-tuxcare.8", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.11-tuxcare.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22732 is fixed in version 5.7.11-tuxcare.8 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2026-22732" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.11-tuxcare.8", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.11-tuxcare.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22747 is fixed in version 5.7.11-tuxcare.8 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2026-22747" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.11-tuxcare.8", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.11-tuxcare.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22754 does not affect version 5.7.11-tuxcare.8 of org.springframework.security:spring-security-web. According to security advisories CVE-2026-22754 does not affect Spring-Security versions earlier than 7.0.0. This is supported by manual code inspection and proof-of-concept tests ported from the upstream fix commit. CVE-2026-22754 is an access-control bypass caused by PathPatternRequestMatcherFactoryBean.afterPropertiesSet() calling this.builder.basePath(this.basePath) and discarding the return value \u2014 PathPatternRequestMatcher.Builder is immutable/copy-on-modify, so the configured basePath was silently dropped and protected URLs (e.g., /spring/path) were left unmatched by the security filter chain. The vulnerability requires two pieces of infrastructure introduced in Spring Security 7.0.0: 1. The PathPatternRequestMatcher.Builder API (added in upstream commit 3e53cc2c4a, \"Use PathPatternRequestMatcher in config\"). 2. The PathPatternRequestMatcherFactoryBean class itself \u2014 the exact file patched by upstream commit 53bcf0d1 (the CVE fix). Neither piece exists in version 5.7.11. The upstream POC tests (RegexMatcher, CiRegexMatcher + AuthorizationManager variants) were ported verbatim and pass.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22754" }, "impact_statement": "According to security advisories CVE-2026-22754 does not affect Spring-Security versions earlier than 7.0.0. This is supported by manual code inspection and proof-of-concept tests ported from the upstream fix commit. CVE-2026-22754 is an access-control bypass caused by PathPatternRequestMatcherFactoryBean.afterPropertiesSet() calling this.builder.basePath(this.basePath) and discarding the return value \u2014 PathPatternRequestMatcher.Builder is immutable/copy-on-modify, so the configured basePath was silently dropped and protected URLs (e.g., /spring/path) were left unmatched by the security filter chain. The vulnerability requires two pieces of infrastructure introduced in Spring Security 7.0.0: 1. The PathPatternRequestMatcher.Builder API (added in upstream commit 3e53cc2c4a, \"Use PathPatternRequestMatcher in config\"). 2. The PathPatternRequestMatcherFactoryBean class itself \u2014 the exact file patched by upstream commit 53bcf0d1 (the CVE fix). Neither piece exists in version 5.7.11. The upstream POC tests (RegexMatcher, CiRegexMatcher + AuthorizationManager variants) were ported verbatim and pass." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.11-tuxcare.8", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.11-tuxcare.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41706 is fixed in version 5.7.11-tuxcare.8 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2026-41706" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.11-tuxcare.8", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.11-tuxcare.8" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47838 is fixed in version 5.7.11-tuxcare.8 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2026-47838" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.11-tuxcare.8", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.11-tuxcare.8" } } ], "timestamp": "2026-10-30T12:33:04.556385+00:00", "status_notes": "Vulnerability CVE-2026-47841 does not affect version 5.7.11-tuxcare.8 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 5.7.11 contains no WebAuthn code, so it is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47841" }, "impact_statement": "CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 5.7.11 contains no WebAuthn code, so it is not affected." } ] }