{
  "@id": "urn:uuid:d1d7d4c0-2907-4b25-8d41-cfac0c964c4d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-11T10:14:00.092544+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.8.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.8.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-11T10:14:00.092544+00:00",
      "status_notes": "Vulnerability CVE-2007-1651 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-web. not_affected \u2014 CVE-2007-1651 describes a CSRF vulnerability in OpenID implementations where cached DiscoveryInformation tokens persist in the HTTP session after logout, allowing session restoration attacks. The upstream Spring Security project fixed this vulnerability in commit f5468087c2 (April 2010) by adding session cleanup in the endConsumption method. The target repository (Spring Security 5.8.14.tuxcare...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2007-1651"
      },
      "impact_statement": "not_affected \u2014 CVE-2007-1651 describes a CSRF vulnerability in OpenID implementations where cached DiscoveryInformation tokens persist in the HTTP session after logout, allowing session restoration attacks. The upstream Spring Security project fixed this vulnerability in commit f5468087c2 (April 2010) by adding session cleanup in the endConsumption method. The target repository (Spring Security 5.8.14.tuxcare..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.8.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.8.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-11T10:14:00.092544+00:00",
      "status_notes": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-web 5.8.14-tuxcare.6. CVE-2007-1652 is a vulnerability in JanRain's myOpenID hosted service, on the OpenID\nProvider side. It does not apply to Spring Security in any version.\n\nNo affected software product is on record. The CVE record carries vendor \"n/a\", product\n\"n/a\" and version \"n/a\"; NVD lists a single unversioned CPE, cpe:2.3:a:openid:openid:*,\nwith no version bounds; the GitHub advisory GHSA-3x88-xvgr-m6fg is unreviewed and lists\nno affected package in any ecosystem; OSV has no entry for any spring-security artifact\n(control: the same query returns 5 entries for spring-security-config and 31 for\nspring-security-core); and spring.io publishes no advisory for this CVE. Every one of the\neight references points to JanRain's myOpenID security-fix announcement of March 2007 or\nto the openid.net security mailing list threads of the same month, where the reporter\nstates the problem had to be fixed on the myOpenID server.\n\nThe reported mechanism is Provider-side by construction. A crafted web page uses a cached\nauthentication token and an existing Provider session to forcibly log a user into an\nOpenID-enabled site, release the user's personal information to it, and silently add that\nsite to the user's trusted-sites list. A trusted-sites auto-approval list exists only at\nan OpenID Provider; a relying party has no such list and no auto-approval step at which\nthe flaw could occur.\n\nThe openid module of Spring Security implements only the relying-party (consumer) role.\nOpenIDAuthenticationFilter drives the two-leg consumer flow and OpenID4JavaConsumer wraps\nopenid4java's ConsumerManager. The only openid4java packages referenced in the tree are\nconsumer, discovery, message and association - there is no use of org.openid4java.server,\nno ServerManager, no OpenID Provider implementation, and no trusted-sites or auto-approval\nhandling of any kind. No openid4java sources are vendored into the tree.\n\nNor could this library have been affected when the issue was disclosed: the CVE was\npublished on 24 March 2007, while the earliest OpenID code in the project dates from\n20 April 2007 and only reached the shipped openid module in January 2008.\n\nResolved consistently with spring-security 5.6.10 (VPV 9976), 5.7.11 (43741),\n5.7.12 (12031), 5.7.14 (40534) and 5.8.16 (330), all closed as false_positive.",
      "vulnerability": {
        "name": "CVE-2007-1652"
      },
      "impact_statement": "CVE-2007-1652 is a vulnerability in JanRain's myOpenID hosted service, on the OpenID\nProvider side. It does not apply to Spring Security in any version.\n\nNo affected software product is on record. The CVE record carries vendor \"n/a\", product\n\"n/a\" and version \"n/a\"; NVD lists a single unversioned CPE, cpe:2.3:a:openid:openid:*,\nwith no version bounds; the GitHub advisory GHSA-3x88-xvgr-m6fg is unreviewed and lists\nno affected package in any ecosystem; OSV has no entry for any spring-security artifact\n(control: the same query returns 5 entries for spring-security-config and 31 for\nspring-security-core); and spring.io publishes no advisory for this CVE. Every one of the\neight references points to JanRain's myOpenID security-fix announcement of March 2007 or\nto the openid.net security mailing list threads of the same month, where the reporter\nstates the problem had to be fixed on the myOpenID server.\n\nThe reported mechanism is Provider-side by construction. A crafted web page uses a cached\nauthentication token and an existing Provider session to forcibly log a user into an\nOpenID-enabled site, release the user's personal information to it, and silently add that\nsite to the user's trusted-sites list. A trusted-sites auto-approval list exists only at\nan OpenID Provider; a relying party has no such list and no auto-approval step at which\nthe flaw could occur.\n\nThe openid module of Spring Security implements only the relying-party (consumer) role.\nOpenIDAuthenticationFilter drives the two-leg consumer flow and OpenID4JavaConsumer wraps\nopenid4java's ConsumerManager. The only openid4java packages referenced in the tree are\nconsumer, discovery, message and association - there is no use of org.openid4java.server,\nno ServerManager, no OpenID Provider implementation, and no trusted-sites or auto-approval\nhandling of any kind. No openid4java sources are vendored into the tree.\n\nNor could this library have been affected when the issue was disclosed: the CVE was\npublished on 24 March 2007, while the earliest OpenID code in the project dates from\n20 April 2007 and only reached the shipped openid module in January 2008.\n\nResolved consistently with spring-security 5.6.10 (VPV 9976), 5.7.11 (43741),\n5.7.12 (12031), 5.7.14 (40534) and 5.8.16 (330), all closed as false_positive."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.8.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.8.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-11T10:14:00.092544+00:00",
      "status_notes": "Vulnerability CVE-2021-22112 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-web. CVE-2021-22112 affects Spring Security versions prior to 5.4.4 (and earlier branches). The target is Spring Security 5.8.14, which already contains the upstream fix (commit c72a6fac from 2021-01-22). The fix was shipped in upstream Spring Security 5.4.4+ and is present in the 5.8.14 release that TuxCare onboarded. The vulnerable code pattern (missing isSaveContextInvoked tracking flag) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22112"
      },
      "impact_statement": "CVE-2021-22112 affects Spring Security versions prior to 5.4.4 (and earlier branches). The target is Spring Security 5.8.14, which already contains the upstream fix (commit c72a6fac from 2021-01-22). The fix was shipped in upstream Spring Security 5.4.4+ and is present in the 5.8.14 release that TuxCare onboarded. The vulnerable code pattern (missing isSaveContextInvoked tracking flag) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.8.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.8.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-11T10:14:00.092544+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-web. CVE-2022-22978 is NOT present in Spring Security 5.8.14. The vulnerability involved RegexRequestMatcher compiling regex patterns without the DOTALL flag, allowing attackers to inject line terminators (\\n, \\r via %0A, %0D) to bypass authorization checks when patterns used `.` metacharacter. The target code at web/src/main/java/org/springframework/security/web/util/matcher/RegexRequestMatcher.java:47 defines `DEFAULT = Pattern.DOTALL`, which is the fix. This fix was introduced by upstream commit 538252cf07 (authored by Rob Winch) and was already present in Spring Security 5.8.14 when TuxCare onboarded it (commit 5b61a4c84b). The vulnerable pattern (DEFAULT=0) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "CVE-2022-22978 is NOT present in Spring Security 5.8.14. The vulnerability involved RegexRequestMatcher compiling regex patterns without the DOTALL flag, allowing attackers to inject line terminators (\\n, \\r via %0A, %0D) to bypass authorization checks when patterns used `.` metacharacter. The target code at web/src/main/java/org/springframework/security/web/util/matcher/RegexRequestMatcher.java:47 defines `DEFAULT = Pattern.DOTALL`, which is the fix. This fix was introduced by upstream commit 538252cf07 (authored by Rob Winch) and was already present in Spring Security 5.8.14 when TuxCare onboarded it (commit 5b61a4c84b). The vulnerable pattern (DEFAULT=0) is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.8.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.8.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-11T10:14:00.092544+00:00",
      "status_notes": "Vulnerability CVE-2024-38821 is fixed in version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2024-38821"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.8.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.8.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-11T10:14:00.092544+00:00",
      "status_notes": "Vulnerability CVE-2026-22732 is fixed in version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-22732"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.8.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.8.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-11T10:14:00.092544+00:00",
      "status_notes": "Vulnerability CVE-2026-22747 is fixed in version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-22747"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.8.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.8.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-11T10:14:00.092544+00:00",
      "status_notes": "Vulnerability CVE-2026-22754 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-web. Spring Security 5.8.14 is NOT affected by CVE-2026-22754. The vulnerability exists only in versions 7.0.0-7.0.4 and is specific to the PathPatternRequestMatcher architecture introduced in version 7.x. Version 5.8.14 uses the MvcRequestMatcher architecture which correctly handles servlet-path configuration through property injection and mutable builder patterns, with no builder return-value capture bug. The authorization bypass described in the CVE cannot occur in 5.8.14's architecture.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-22754"
      },
      "impact_statement": "Spring Security 5.8.14 is NOT affected by CVE-2026-22754. The vulnerability exists only in versions 7.0.0-7.0.4 and is specific to the PathPatternRequestMatcher architecture introduced in version 7.x. Version 5.8.14 uses the MvcRequestMatcher architecture which correctly handles servlet-path configuration through property injection and mutable builder patterns, with no builder return-value capture bug. The authorization bypass described in the CVE cannot occur in 5.8.14's architecture."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.8.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.8.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-11T10:14:00.092544+00:00",
      "status_notes": "Vulnerability CVE-2026-41706 is fixed in version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-41706"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.8.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.8.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-11T10:14:00.092544+00:00",
      "status_notes": "Vulnerability CVE-2026-47838 is fixed in version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-47838"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.8.14-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.8.14-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-11T10:14:00.092544+00:00",
      "status_notes": "Vulnerability CVE-2026-47841 does not affect version 5.8.14-tuxcare.6 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 5.8.14 contains no WebAuthn code, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-47841"
      },
      "impact_statement": "CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 5.8.14 contains no WebAuthn code, so it is not affected."
    }
  ]
}