{
  "@id": "urn:uuid:040dcd82-0081-4052-be5c-857e37d40fb9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 32,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:47:30.687322+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:47:30.687322+00:00",
      "status_notes": "Vulnerability CVE-2021-22112 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-web. CVE-2021-22112 is NOT present in Spring Security 6.0.7. The vulnerability\u2014failure to save SecurityContext when changed multiple times in a single request\u2014was fixed in upstream commit c72a6fac04 (2021-01-22) by adding an isSaveContextInvoked flag to ensure the final SecurityContext state is persisted. This fix was already present in the upstream Spring Security 6.0.7 release that TuxCare onboarded on 2026-09-14. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22112"
      },
      "impact_statement": "CVE-2021-22112 is NOT present in Spring Security 6.0.7. The vulnerability\u2014failure to save SecurityContext when changed multiple times in a single request\u2014was fixed in upstream commit c72a6fac04 (2021-01-22) by adding an isSaveContextInvoked flag to ensure the final SecurityContext state is persisted. This fix was already present in the upstream Spring Security 6.0.7 release that TuxCare onboarded on 2026-09-14. The vulnerable code pattern does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:20:19.402749+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-web. CVE-2022-22978 describes an authorization bypass vulnerability in Spring Security's RegexRequestMatcher when using `.` in regex patterns. Without the Pattern.DOTALL flag, the `.` metacharacter does not match newline characters (\\n, \\r), allowing attackers to bypass regex-based authorization rules by injecting newlines into request paths (e.g., /admin%0a/sensitive bypassing /admin.* protection). The target repository (Spring Security 6.0.7-tuxcare.2) contains the fix: Pattern.DOTALL is set as the default regex flag at line 46 of RegexRequestMatcher.java. This fix was authored by upstream maintainer Rob Winch on 2022-05-12 and was already present in the Spring Security 6.0.7 release before TuxCare onboarded it on 2026-09-14. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "CVE-2022-22978 describes an authorization bypass vulnerability in Spring Security's RegexRequestMatcher when using `.` in regex patterns. Without the Pattern.DOTALL flag, the `.` metacharacter does not match newline characters (\\n, \\r), allowing attackers to bypass regex-based authorization rules by injecting newlines into request paths (e.g., /admin%0a/sensitive bypassing /admin.* protection). The target repository (Spring Security 6.0.7-tuxcare.2) contains the fix: Pattern.DOTALL is set as the default regex flag at line 46 of RegexRequestMatcher.java. This fix was authored by upstream maintainer Rob Winch on 2022-05-12 and was already present in the Spring Security 6.0.7 release before TuxCare onboarded it on 2026-09-14. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T15:53:00.128527+00:00",
      "status_notes": "Vulnerability CVE-2024-38821 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2024-38821"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T15:53:00.128527+00:00",
      "status_notes": "Vulnerability CVE-2026-22732 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-22732"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T15:53:00.128527+00:00",
      "status_notes": "Vulnerability CVE-2026-22747 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-22747"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T15:50:31.895445+00:00",
      "status_notes": "Vulnerability CVE-2026-22754 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-web. Version 6.0.7 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcherFactoryBean (introduced in Spring Security 7.0.0) where a builder reassignment bug causes servlet-path configurations to be ignored. Version 6.0.7 does not contain PathPatternRequestMatcher or PathPatternRequestMatcherFactoryBean. Instead, it uses MvcRequestMatcher for servlet-path support, which correctly handles the configuration without the builder bug. The CVE's affected version range (7.0.0-7.0.4) is accurate; this vulnerability was introduced with new functionality in 7.0.0 and never existed in 6.0.7.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22754"
      },
      "impact_statement": "Version 6.0.7 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcherFactoryBean (introduced in Spring Security 7.0.0) where a builder reassignment bug causes servlet-path configurations to be ignored. Version 6.0.7 does not contain PathPatternRequestMatcher or PathPatternRequestMatcherFactoryBean. Instead, it uses MvcRequestMatcher for servlet-path support, which correctly handles the configuration without the builder bug. The CVE's affected version range (7.0.0-7.0.4) is accurate; this vulnerability was introduced with new functionality in 7.0.0 and never existed in 6.0.7."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T15:53:00.128527+00:00",
      "status_notes": "Vulnerability CVE-2026-41706 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-41706"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T15:53:00.128527+00:00",
      "status_notes": "Vulnerability CVE-2026-47838 is fixed in version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-47838"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T12:34:56.763245+00:00",
      "status_notes": "Vulnerability CVE-2026-47841 does not affect version 6.0.7-tuxcare.1 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 6.0.7 contains no WebAuthn code, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-47841"
      },
      "impact_statement": "CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 6.0.7 contains no WebAuthn code, so it is not affected."
    }
  ]
}