{
  "@id": "urn:uuid:d7cf6584-4503-4c50-9d3a-938dd0b167e2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-xml@3.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-xml@3.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2019-3773 does not affect version 3.1.6-tuxcare.2 of org.springframework.ws:spring-xml. CVE-2019-3773 (XXE vulnerability) is not present in Spring WS 3.1.6. The fix was already included in the upstream v3.1.6 release that TuxCare onboarded. The target repository contains comprehensive XXE protections via DocumentBuilderFactoryUtils, XMLInputFactoryUtils, and TransformerFactoryUtils utility classes that configure XML parsers with secure defaults to prevent external entity processing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.4; >= 3.0.0, < 3.0.6; < 2.4.4; >= 3.0.0, < 3.0.6), Snyk (< 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE; < 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3773"
      },
      "impact_statement": "CVE-2019-3773 (XXE vulnerability) is not present in Spring WS 3.1.6. The fix was already included in the upstream v3.1.6 release that TuxCare onboarded. The target repository contains comprehensive XXE protections via DocumentBuilderFactoryUtils, XMLInputFactoryUtils, and TransformerFactoryUtils utility classes that configure XML parsers with secure defaults to prevent external entity processing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.4; >= 3.0.0, < 3.0.6; < 2.4.4; >= 3.0.0, < 3.0.6), Snyk (< 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE; < 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-xml@3.1.6-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-xml@3.1.6-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T08:20:00.172803+00:00",
      "status_notes": "Vulnerability CVE-2026-40998 is fixed in version 3.1.6-tuxcare.2 of org.springframework.ws:spring-xml.",
      "vulnerability": {
        "name": "CVE-2026-40998"
      }
    }
  ]
}