{
  "@id": "urn:uuid:3ca5c235-fcf8-42d6-99b6-e9b6ff83bf02",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-xml@4.0.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-xml@4.0.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2019-3773 does not affect version 4.0.10-tuxcare.2 of org.springframework.ws:spring-xml. CVE-2019-3773 (XXE vulnerability) is not present in Spring Web Services 4.0.10-tuxcare.2. The fix was already included in the upstream 4.0.10 release before TuxCare onboarded it. The fix introduced secure utility classes (DocumentBuilderFactoryUtils, XMLInputFactoryUtils, TransformerFactoryUtils, etc.) that disable external entity processing by setting ACCESS_EXTERNAL_DTD=\"\", ACCESS_EXTERNAL_SCHEMA=\"\", SUPPORT_DTD=false, external-general-entities=false, external-parameter-entities=false, disallow-doctype-decl=true, and expandEntityReferences=false. All code paths that process untrusted XML input use these secure utilities.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.4; >= 3.0.0, < 3.0.6; < 2.4.4; >= 3.0.0, < 3.0.6), Snyk (< 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE; < 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3773"
      },
      "impact_statement": "CVE-2019-3773 (XXE vulnerability) is not present in Spring Web Services 4.0.10-tuxcare.2. The fix was already included in the upstream 4.0.10 release before TuxCare onboarded it. The fix introduced secure utility classes (DocumentBuilderFactoryUtils, XMLInputFactoryUtils, TransformerFactoryUtils, etc.) that disable external entity processing by setting ACCESS_EXTERNAL_DTD=\"\", ACCESS_EXTERNAL_SCHEMA=\"\", SUPPORT_DTD=false, external-general-entities=false, external-parameter-entities=false, disallow-doctype-decl=true, and expandEntityReferences=false. All code paths that process untrusted XML input use these secure utilities.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.4; >= 3.0.0, < 3.0.6; < 2.4.4; >= 3.0.0, < 3.0.6), Snyk (< 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE; < 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-xml@4.0.10-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-xml@4.0.10-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T15:22:02.619954+00:00",
      "status_notes": "Vulnerability CVE-2026-40998 is fixed in version 4.0.10-tuxcare.2 of org.springframework.ws:spring-xml.",
      "vulnerability": {
        "name": "CVE-2026-40998"
      }
    }
  ]
}