{
  "@id": "urn:uuid:5f36fde5-8820-4a75-9d62-6b03ad6ccccb",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:02:00.202619+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-xml@4.0.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-xml@4.0.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:02:00.202619+00:00",
      "status_notes": "Vulnerability CVE-2019-3773 does not affect version 4.0.14-tuxcare.2 of org.springframework.ws:spring-xml. CVE-2019-3773 (XXE vulnerability) is not present in Spring Web Services 4.0.14-tuxcare.3. The upstream vendor (Spring team) fixed this vulnerability in commit 1f05307d6 (Dec 2018) by creating safe XML parser factory utilities (DocumentBuilderFactoryUtils, XMLReaderFactoryUtils) that configure all parsers with XXE protections. These utilities are actively used throughout the codebase for all untrusted XML input processing. The fix was already included in upstream release 4.0.14 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.4; >= 3.0.0, < 3.0.6), Snyk (< 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE; < 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3773"
      },
      "impact_statement": "CVE-2019-3773 (XXE vulnerability) is not present in Spring Web Services 4.0.14-tuxcare.3. The upstream vendor (Spring team) fixed this vulnerability in commit 1f05307d6 (Dec 2018) by creating safe XML parser factory utilities (DocumentBuilderFactoryUtils, XMLReaderFactoryUtils) that configure all parsers with XXE protections. These utilities are actively used throughout the codebase for all untrusted XML input processing. The fix was already included in upstream release 4.0.14 before TuxCare onboarded it.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.4; >= 3.0.0, < 3.0.6), Snyk (< 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE; < 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-xml@4.0.14-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-xml@4.0.14-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-13T08:14:00.064025+00:00",
      "status_notes": "Vulnerability CVE-2026-40998 is fixed in version 4.0.14-tuxcare.2 of org.springframework.ws:spring-xml.",
      "vulnerability": {
        "name": "CVE-2026-40998"
      }
    }
  ]
}