{
  "@id": "urn:uuid:f892ad38-12ad-4c22-9d5c-b60de975bd00",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T12:06:19.646745+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-xml@3.1.4-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-xml@3.1.4-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T12:06:19.646745+00:00",
      "status_notes": "Vulnerability CVE-2019-3773 does not affect version 3.1.4-tuxcare.6 of org.springframework.ws:spring-xml. Spring Web Services 3.1.4-tuxcare.2 is not affected by CVE-2019-3773 (XXE vulnerability). The upstream vendor (VMware/Pivotal) fixed this vulnerability in commit 1f05307d6 (SWS-1049) before releasing v3.1.4. The fix introduced secure XML parser factory utilities (DocumentBuilderFactoryUtils, XMLInputFactoryUtils, TransformerFactoryUtils, etc.) that disable external entity resolution, DTD processing, and other XXE attack vectors. TuxCare onboarded the already-fixed v3.1.4 release, so the vulnerability pattern is not present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.4; >= 3.0.0, < 3.0.6; < 2.4.4; >= 3.0.0, < 3.0.6), Snyk (< 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE; < 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3773"
      },
      "impact_statement": "Spring Web Services 3.1.4-tuxcare.2 is not affected by CVE-2019-3773 (XXE vulnerability). The upstream vendor (VMware/Pivotal) fixed this vulnerability in commit 1f05307d6 (SWS-1049) before releasing v3.1.4. The fix introduced secure XML parser factory utilities (DocumentBuilderFactoryUtils, XMLInputFactoryUtils, TransformerFactoryUtils, etc.) that disable external entity resolution, DTD processing, and other XXE attack vectors. TuxCare onboarded the already-fixed v3.1.4 release, so the vulnerability pattern is not present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.4; >= 3.0.0, < 3.0.6; < 2.4.4; >= 3.0.0, < 3.0.6), Snyk (< 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE; < 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-xml@3.1.4-tuxcare.6",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-xml@3.1.4-tuxcare.6"
          }
        }
      ],
      "timestamp": "2026-11-12T12:06:19.646745+00:00",
      "status_notes": "Vulnerability CVE-2026-40998 is fixed in version 3.1.4-tuxcare.6 of org.springframework.ws:spring-xml.",
      "vulnerability": {
        "name": "CVE-2026-40998"
      }
    }
  ]
}