{
  "@id": "urn:uuid:72e7b621-5fb7-48e2-b4b7-8318e6214840",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T02:51:00.069477+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:07:07.460514+00:00",
      "status_notes": "Vulnerability CVE-2021-22112 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2021-22112"
      },
      "action_statement": "Vulnerability CVE-2021-22112 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:07:07.460514+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "action_statement": "Vulnerability CVE-2022-22978 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T02:51:00.069477+00:00",
      "status_notes": "Vulnerability CVE-2024-38821 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-web, and is fixed in 5.7.6-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2024-38821"
      },
      "action_statement": "Vulnerability CVE-2024-38821 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-web, and is fixed in 5.7.6-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T02:51:00.069477+00:00",
      "status_notes": "Vulnerability CVE-2026-22732 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-web, and is fixed in 5.7.6-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-22732"
      },
      "action_statement": "Vulnerability CVE-2026-22732 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-web, and is fixed in 5.7.6-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:40:00.636701+00:00",
      "status_notes": "Vulnerability CVE-2026-22747 does not affect version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 CVE-2026-22747 affects SubjectX500PrincipalExtractor, which does not exist in spring-security 5.7.6. The only extractor in the tree is the deprecated regex-based SubjectDnX509PrincipalExtractor. The CVE advisory says this class is explicitly outside the scope of the fix. The vulnerable component is therefore absent from the target. Residual caveat: the regex extractor has the same general weakn...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22747"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-22747 affects SubjectX500PrincipalExtractor, which does not exist in spring-security 5.7.6. The only extractor in the tree is the deprecated regex-based SubjectDnX509PrincipalExtractor. The CVE advisory says this class is explicitly outside the scope of the fix. The vulnerable component is therefore absent from the target. Residual caveat: the regex extractor has the same general weakn..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:23:00.116664+00:00",
      "status_notes": "Vulnerability CVE-2026-22754 does not affect version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-web. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.7.6 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4vrc-j85c-598c (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22754"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.7.6 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4vrc-j85c-598c (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T02:51:00.069477+00:00",
      "status_notes": "Vulnerability CVE-2026-41706 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-web, and is fixed in 5.7.6-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-41706"
      },
      "action_statement": "Vulnerability CVE-2026-41706 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-web, and is fixed in 5.7.6-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T08:07:07.460514+00:00",
      "status_notes": "Vulnerability CVE-2026-47838 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-47838"
      },
      "action_statement": "Vulnerability CVE-2026-47838 affects version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:26:30.048967+00:00",
      "status_notes": "Vulnerability CVE-2026-47841 does not affect version 5.7.6-tuxcare.1 of org.springframework.security:spring-security-web. Prechecker: No vulnerable code from the fix was found; the vulnerable lines are absent, this version declares none of the classes the fix changes, and their base package is absent. Version 5.7.6 is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-47841"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; the vulnerable lines are absent, this version declares none of the classes the fix changes, and their base package is absent. Version 5.7.6 is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only)."
    }
  ]
}