{ "@id": "urn:uuid:836c1911-7efa-474c-b6bf-9b6b3ca27b93", "role": "Document Creator", "author": "https://tuxcare.com", "version": 36, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T18:17:00.464761+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.8.16-tuxcare.14", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.8.16-tuxcare.14" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2007-1651 is a false positive for org.springframework.security:spring-security-web 5.8.16-tuxcare.14. direct vulnerability is in OpenID project", "vulnerability": { "name": "CVE-2007-1651" }, "impact_statement": "direct vulnerability is in OpenID project" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.8.16-tuxcare.14", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.8.16-tuxcare.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-web 5.8.16-tuxcare.14. CVE-2007-1652 is a vulnerability in JanRain's myOpenID service, on the OpenID Provider side. The CVE record carries vendor and product \\\"n/a\\\" and a single version-unbounded CPE, cpe:2.3:a:openid:openid:*, and every reference points to JanRain's myOpenID security announcement of March 2007 and the openid.net security mailing list threads of the same month. The reported mechanism - a crafted web page that forcibly logs a user into an OpenID-enabled site, releases the user's personal information to it, and silently adds it to the user's trusted-sites list by way of a cached authentication token - consists entirely of decisions taken by an OpenID Provider. A relying party has no trusted-sites list and no auto-approval step at which the flaw could occur. The openid module of this library implements only the relying-party (consumer) role: OpenIDAuthenticationFilter drives the two-leg consumer flow and OpenID4JavaConsumer wraps openid4java's ConsumerManager. The tree contains no OpenID Provider implementation - no use of openid4java's server package or ServerManager - and no trusted-sites or auto-approval handling anywhere. Nor could this library have been affected when the issue was disclosed: the CVE was published on 24 March 2007, while the earliest OpenID code in the project dates from 20 April 2007 and only reached the shipped openid module in January 2008. The vulnerability therefore does not apply to this library in any version.", "vulnerability": { "name": "CVE-2007-1652" }, "impact_statement": "CVE-2007-1652 is a vulnerability in JanRain's myOpenID service, on the OpenID Provider side. The CVE record carries vendor and product \\\"n/a\\\" and a single version-unbounded CPE, cpe:2.3:a:openid:openid:*, and every reference points to JanRain's myOpenID security announcement of March 2007 and the openid.net security mailing list threads of the same month. The reported mechanism - a crafted web page that forcibly logs a user into an OpenID-enabled site, releases the user's personal information to it, and silently adds it to the user's trusted-sites list by way of a cached authentication token - consists entirely of decisions taken by an OpenID Provider. A relying party has no trusted-sites list and no auto-approval step at which the flaw could occur. The openid module of this library implements only the relying-party (consumer) role: OpenIDAuthenticationFilter drives the two-leg consumer flow and OpenID4JavaConsumer wraps openid4java's ConsumerManager. The tree contains no OpenID Provider implementation - no use of openid4java's server package or ServerManager - and no trusted-sites or auto-approval handling anywhere. Nor could this library have been affected when the issue was disclosed: the CVE was published on 24 March 2007, while the earliest OpenID code in the project dates from 20 April 2007 and only reached the shipped openid module in January 2008. The vulnerability therefore does not apply to this library in any version." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.8.16-tuxcare.14", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.8.16-tuxcare.14" } } ], "timestamp": "2026-11-03T12:41:05.137822+00:00", "status_notes": "Vulnerability CVE-2021-22112 does not affect version 5.8.16-tuxcare.14 of org.springframework.security:spring-security-web. CVE-2021-22112 is not present in Spring Security 5.8.16. The vulnerability, which could cause SecurityContext changes to fail to persist when changed multiple times in a single request, was fixed upstream in commit 3116369f02 (Jan 22, 2021) before the 5.8.16 release. The fix introduces an isSaveContextInvoked flag to track save operations and modifies contextChanged() to ensure subsequent saves always write to the session. This upstream fix was already present when TuxCare onboarded version 5.8.16.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-22112" }, "impact_statement": "CVE-2021-22112 is not present in Spring Security 5.8.16. The vulnerability, which could cause SecurityContext changes to fail to persist when changed multiple times in a single request, was fixed upstream in commit 3116369f02 (Jan 22, 2021) before the 5.8.16 release. The fix introduces an isSaveContextInvoked flag to track save operations and modifies contextChanged() to ensure subsequent saves always write to the session. This upstream fix was already present when TuxCare onboarded version 5.8.16.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.8.16-tuxcare.14", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.8.16-tuxcare.14" } } ], "timestamp": "2026-11-03T12:15:19.421943+00:00", "status_notes": "Vulnerability CVE-2022-22978 does not affect version 5.8.16-tuxcare.14 of org.springframework.security:spring-security-web. The target Spring Security 5.8.16 is NOT affected by CVE-2022-22978. The vulnerability (RegexRequestMatcher bypass via newline characters in request paths) was fixed in the upstream release that TuxCare onboarded. The fix commit c6461d61ba (authored by Rob Winch) changed DEFAULT from 0 to Pattern.DOTALL, making the '.' regex metacharacter match newline characters and preventing authorization bypass. This upstream fix is present at HEAD (8ff5eacf77) and predates the first TuxCare commit (f09fc6dd88), confirming it shipped in the base upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22978" }, "impact_statement": "The target Spring Security 5.8.16 is NOT affected by CVE-2022-22978. The vulnerability (RegexRequestMatcher bypass via newline characters in request paths) was fixed in the upstream release that TuxCare onboarded. The fix commit c6461d61ba (authored by Rob Winch) changed DEFAULT from 0 to Pattern.DOTALL, making the '.' regex metacharacter match newline characters and preventing authorization bypass. This upstream fix is present at HEAD (8ff5eacf77) and predates the first TuxCare commit (f09fc6dd88), confirming it shipped in the base upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.8.16-tuxcare.14", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.8.16-tuxcare.14" } } ], "timestamp": "2026-11-06T18:17:00.464761+00:00", "status_notes": "Vulnerability CVE-2024-38821 does not affect version 5.8.16-tuxcare.14 of org.springframework.security:spring-security-web. Prechecker: The upstream fix is already in this version's source history (commit 4ce7cde1). The upstream fix was released in 5.8.15, and version 5.8.16 is a later release of the same line. Advisories: GitHub GHSA-c4q5-6c82-3qpw (fixed in 5.8.15), CVE record (fixed in 5.8.15), Snyk (fixed in 5.8.15).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-38821" }, "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commit 4ce7cde1). The upstream fix was released in 5.8.15, and version 5.8.16 is a later release of the same line. Advisories: GitHub GHSA-c4q5-6c82-3qpw (fixed in 5.8.15), CVE record (fixed in 5.8.15), Snyk (fixed in 5.8.15)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.8.16-tuxcare.14", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.8.16-tuxcare.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22732 is fixed in version 5.8.16-tuxcare.14 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2026-22732" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.8.16-tuxcare.14", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.8.16-tuxcare.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22747 is fixed in version 5.8.16-tuxcare.14 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2026-22747" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.8.16-tuxcare.14", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.8.16-tuxcare.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22754 does not affect version 5.8.16-tuxcare.14 of org.springframework.security:spring-security-web. According to security advisories CVE-2026-22754 does not affect Spring-Security versions earlier than 7.0.0. This is supported by manual code inspection and proof-of-concept tests ported from the upstream fix commit. CVE-2026-22754 is an access-control bypass caused by PathPatternRequestMatcherFactoryBean.afterPropertiesSet() calling this.builder.basePath(this.basePath) and discarding the return value \u2014 PathPatternRequestMatcher.Builder is immutable/copy-on-modify, so the configured basePath was silently dropped and protected URLs (e.g., /spring/path) were left unmatched by the security filter chain. The vulnerability requires two pieces of infrastructure introduced in Spring Security 7.0.0: 1. The PathPatternRequestMatcher.Builder API (added in upstream commit 3e53cc2c4a, \"Use PathPatternRequestMatcher in config\"). 2. The PathPatternRequestMatcherFactoryBean class itself \u2014 the exact file patched by upstream commit 53bcf0d1 (the CVE fix). Neither piece exists in version 5.8.16. The upstream POC tests (RegexMatcher, CiRegexMatcher + AuthorizationManager variants) were ported verbatim and pass.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22754" }, "impact_statement": "According to security advisories CVE-2026-22754 does not affect Spring-Security versions earlier than 7.0.0. This is supported by manual code inspection and proof-of-concept tests ported from the upstream fix commit. CVE-2026-22754 is an access-control bypass caused by PathPatternRequestMatcherFactoryBean.afterPropertiesSet() calling this.builder.basePath(this.basePath) and discarding the return value \u2014 PathPatternRequestMatcher.Builder is immutable/copy-on-modify, so the configured basePath was silently dropped and protected URLs (e.g., /spring/path) were left unmatched by the security filter chain. The vulnerability requires two pieces of infrastructure introduced in Spring Security 7.0.0: 1. The PathPatternRequestMatcher.Builder API (added in upstream commit 3e53cc2c4a, \"Use PathPatternRequestMatcher in config\"). 2. The PathPatternRequestMatcherFactoryBean class itself \u2014 the exact file patched by upstream commit 53bcf0d1 (the CVE fix). Neither piece exists in version 5.8.16. The upstream POC tests (RegexMatcher, CiRegexMatcher + AuthorizationManager variants) were ported verbatim and pass." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.8.16-tuxcare.14", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.8.16-tuxcare.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41706 is fixed in version 5.8.16-tuxcare.14 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2026-41706" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.8.16-tuxcare.14", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.8.16-tuxcare.14" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47838 is fixed in version 5.8.16-tuxcare.14 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2026-47838" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.8.16-tuxcare.14", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.8.16-tuxcare.14" } } ], "timestamp": "2026-10-30T12:34:56.763245+00:00", "status_notes": "Vulnerability CVE-2026-47841 does not affect version 5.8.16-tuxcare.14 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 5.8.16 contains no WebAuthn code, so it is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47841" }, "impact_statement": "CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 5.8.16 contains no WebAuthn code, so it is not affected." } ] }