{
  "@id": "urn:uuid:4c04ba88-e277-4284-819f-fc047e62c136",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 36,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:18:00.046080+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.5.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.5.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:44:25.010068+00:00",
      "status_notes": "Vulnerability CVE-2021-22112 does not affect version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-web. The target repository (Spring Security 6.5.11-tuxcare.4) is not affected by CVE-2021-22112. The vulnerability was fixed in upstream Spring Security commit c72a6fac04, which was already present in the upstream release before TuxCare began maintenance. The fix introduces proper tracking of saveContext invocations via the isSaveContextInvoked field, ensuring that SecurityContext changes made after an initial save are correctly detected and persisted to the session.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22112"
      },
      "impact_statement": "The target repository (Spring Security 6.5.11-tuxcare.4) is not affected by CVE-2021-22112. The vulnerability was fixed in upstream Spring Security commit c72a6fac04, which was already present in the upstream release before TuxCare began maintenance. The fix introduces proper tracking of saveContext invocations via the isSaveContextInvoked field, ensuring that SecurityContext changes made after an initial save are correctly detected and persisted to the session.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.5.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.5.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:18:14.184922+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-web. Spring Security 6.5.11 is NOT AFFECTED by CVE-2022-22978. The vulnerability (RegexRequestMatcher missing Pattern.DOTALL flag, allowing authorization bypass via newline characters in request paths) is not present in this version. The fix was authored by upstream maintainer Rob Winch (commit 472c25b5e8) and shipped in the upstream Spring Security 6.5.11 release before TuxCare onboarded it. The target contains Pattern.DOTALL at line 46 of RegexRequestMatcher.java, ensuring the `.` metacharacter matches line terminators, preventing bypass attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "Spring Security 6.5.11 is NOT AFFECTED by CVE-2022-22978. The vulnerability (RegexRequestMatcher missing Pattern.DOTALL flag, allowing authorization bypass via newline characters in request paths) is not present in this version. The fix was authored by upstream maintainer Rob Winch (commit 472c25b5e8) and shipped in the upstream Spring Security 6.5.11 release before TuxCare onboarded it. The target contains Pattern.DOTALL at line 46 of RegexRequestMatcher.java, ensuring the `.` metacharacter matches line terminators, preventing bypass attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.5.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.5.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T18:18:00.046080+00:00",
      "status_notes": "Vulnerability CVE-2024-38821 does not affect version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-web. Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. Version 6.5.11 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-c4q5-6c82-3qpw (affected up to 6.3.4), CVE record (affected up to 6.3.4), Snyk (affected up to 6.3.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38821"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. Version 6.5.11 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-c4q5-6c82-3qpw (affected up to 6.3.4), CVE record (affected up to 6.3.4), Snyk (affected up to 6.3.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.5.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.5.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T11:40:52.629939+00:00",
      "status_notes": "Vulnerability CVE-2026-22732 does not affect version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-web. The target Spring Security 6.5.11-tuxcare.4 is NOT AFFECTED by CVE-2026-22732. The upstream fix (commit 1dae9aa459) was already included in Spring Security 6.5.11 when TuxCare onboarded it. The vulnerable pattern (missing method overrides for setHeader, setIntHeader, addIntHeader in OnCommittedResponseWrapper) does not exist in the target - all four required method overrides are present and properly track Content-Length to prevent premature response commit before security headers are written.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (<= 5.7.14; >= 5.8.0, <= 5.8.16; >= 6.0.0, <= 6.3.10; >= 6.4.0, <= 6.4.13; >= 6.5.0, < 6.5.9; >= 7.0.0, < 7.0.4), NVD (< 5.7.22; >= 5.8.0, < 5.8.24; >= 6.3.0, < 6.3.15; >= 6.4.0, < 6.4.15; >= 6.5.0, < 6.5.9; >= 7.0.0, < 7.0.4), cve.org (>= 5.7.0, <= 5.7.21; >= 5.8.0, <= 5.8.23; >= 6.3.0, <= 6.3.14; >= 6.4.0, <= 6.4.14; >= 6.5.0, <= 6.5.8; >= 7.0.0, <= 7.0.3), Snyk (>= 3.2.8, < 6.5.9; >= 7.0.0-M1, < 7.0.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22732"
      },
      "impact_statement": "The target Spring Security 6.5.11-tuxcare.4 is NOT AFFECTED by CVE-2026-22732. The upstream fix (commit 1dae9aa459) was already included in Spring Security 6.5.11 when TuxCare onboarded it. The vulnerable pattern (missing method overrides for setHeader, setIntHeader, addIntHeader in OnCommittedResponseWrapper) does not exist in the target - all four required method overrides are present and properly track Content-Length to prevent premature response commit before security headers are written.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (<= 5.7.14; >= 5.8.0, <= 5.8.16; >= 6.0.0, <= 6.3.10; >= 6.4.0, <= 6.4.13; >= 6.5.0, < 6.5.9; >= 7.0.0, < 7.0.4), NVD (< 5.7.22; >= 5.8.0, < 5.8.24; >= 6.3.0, < 6.3.15; >= 6.4.0, < 6.4.15; >= 6.5.0, < 6.5.9; >= 7.0.0, < 7.0.4), cve.org (>= 5.7.0, <= 5.7.21; >= 5.8.0, <= 5.8.23; >= 6.3.0, <= 6.3.14; >= 6.4.0, <= 6.4.14; >= 6.5.0, <= 6.5.8; >= 7.0.0, <= 7.0.3), Snyk (>= 3.2.8, < 6.5.9; >= 7.0.0-M1, < 7.0.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.5.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.5.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22747 does not affect version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-web. already_fixed \u2014 The target Spring Security 6.5.11 already contains the fix for CVE-2026-22747. The SubjectX500PrincipalExtractor class uses secure RDN-based DN parsing (via javax.naming.ldap.LdapName and Rdn) instead of vulnerable regex-based parsing. This is the default extractor used by X509AuthenticationFilter. While a deprecated class (SubjectDnX509PrincipalExtractor) with the vulnerable regex pattern stil...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22747"
      },
      "impact_statement": "already_fixed \u2014 The target Spring Security 6.5.11 already contains the fix for CVE-2026-22747. The SubjectX500PrincipalExtractor class uses secure RDN-based DN parsing (via javax.naming.ldap.LdapName and Rdn) instead of vulnerable regex-based parsing. This is the default extractor used by X509AuthenticationFilter. While a deprecated class (SubjectDnX509PrincipalExtractor) with the vulnerable regex pattern stil..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.5.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.5.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22754 does not affect version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Version 6.5.11 is not affected by CVE-2026-22754. The vulnerability is specific to Spring Security 7.0.0-7.0.4 where PathPatternRequestMatcher became the default for XML configuration. Version 6.5.11 uses MvcRequestMatcher for servlet-path handling, which has a fundamentally different architecture and does not exhibit the vulnerable pattern.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22754"
      },
      "impact_statement": "not_affected \u2014 Version 6.5.11 is not affected by CVE-2026-22754. The vulnerability is specific to Spring Security 7.0.0-7.0.4 where PathPatternRequestMatcher became the default for XML configuration. Version 6.5.11 uses MvcRequestMatcher for servlet-path handling, which has a fundamentally different architecture and does not exhibit the vulnerable pattern."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.5.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.5.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41706 does not affect version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 6.5.11 contains the complete fix for CVE-2026-41706 (open redirect via CookieRequestCache). The fix was authored by the upstream Spring Security team (Josh Cummings, commit a14c9d66b1) and included in the official 6.5.11 release before TuxCare onboarded this version. Both CookieRequestCache.java and CookieServerRequestCache.java now store only relative paths in cookies, validate...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41706"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.5.11 contains the complete fix for CVE-2026-41706 (open redirect via CookieRequestCache). The fix was authored by the upstream Spring Security team (Josh Cummings, commit a14c9d66b1) and included in the official 6.5.11 release before TuxCare onboarded this version. Both CookieRequestCache.java and CookieServerRequestCache.java now store only relative paths in cookies, validate..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.5.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.5.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2026-47838 does not affect version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 CVE-2026-47838 is NOT present in Spring Security 6.5.11-tuxcare.4. The vulnerability fix was already included in the upstream Spring Security 6.5.11 release that TuxCare onboarded. The target uses SubjectX500PrincipalExtractor (with proper LdapName/Rdn parsing) as the default for X.509 authentication, not the vulnerable regex-based SubjectDnX509PrincipalExtractor. The upstream fix commit e3ad55...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-47838"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-47838 is NOT present in Spring Security 6.5.11-tuxcare.4. The vulnerability fix was already included in the upstream Spring Security 6.5.11 release that TuxCare onboarded. The target uses SubjectX500PrincipalExtractor (with proper LdapName/Rdn parsing) as the default for X.509 authentication, not the vulnerable regex-based SubjectDnX509PrincipalExtractor. The upstream fix commit e3ad55..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.5.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.5.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T12:33:23.004157+00:00",
      "status_notes": "Vulnerability CVE-2026-47841 affects version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-web, and is fixed in 6.5.11-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-47841"
      },
      "action_statement": "Vulnerability CVE-2026-47841 affects version 6.5.11-tuxcare.1 of org.springframework.security:spring-security-web, and is fixed in 6.5.11-tuxcare.3."
    }
  ]
}