{
  "@id": "urn:uuid:c6d7e4eb-5363-4dd8-8952-e379203395cc",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-xml@3.0.10.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-xml@3.0.10.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2019-3773 does not affect version 3.0.10.RELEASE-tuxcare.2 of org.springframework.ws:spring-xml. CVE-2019-3773 XXE vulnerability is NOT present in spring-ws 3.0.10.RELEASE. The upstream vendor fix (commit 1f05307d6) shipped in this release, creating secure wrapper utilities (DocumentBuilderFactoryUtils, XMLInputFactoryUtils) that disable external entity processing. Production code uses these utilities throughout, eliminating the vulnerable pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.4; >= 3.0.0, < 3.0.6; < 2.4.4; >= 3.0.0, < 3.0.6), Snyk (< 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE; < 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3773"
      },
      "impact_statement": "CVE-2019-3773 XXE vulnerability is NOT present in spring-ws 3.0.10.RELEASE. The upstream vendor fix (commit 1f05307d6) shipped in this release, creating secure wrapper utilities (DocumentBuilderFactoryUtils, XMLInputFactoryUtils) that disable external entity processing. Production code uses these utilities throughout, eliminating the vulnerable pattern.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.4; >= 3.0.0, < 3.0.6; < 2.4.4; >= 3.0.0, < 3.0.6), Snyk (< 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE; < 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-xml@3.0.10.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-xml@3.0.10.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T07:45:26.962865+00:00",
      "status_notes": "Vulnerability CVE-2026-40998 is fixed in version 3.0.10.RELEASE-tuxcare.2 of org.springframework.ws:spring-xml.",
      "vulnerability": {
        "name": "CVE-2026-40998"
      }
    }
  ]
}