{
  "@id": "urn:uuid:641265be-31a1-4e40-b5d9-ea50c4cf5db6",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:04:11.456857+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-xml@4.1.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-xml@4.1.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2019-3773 does not affect version 4.1.4-tuxcare.2 of org.springframework.ws:spring-xml. CVE-2019-3773 (XXE vulnerability in Spring Web Services) is NOT present in the target version 4.1.4-tuxcare.4. The upstream vendor (Spring/Pivotal) fixed this vulnerability in commit 1f05307d6 by introducing secure XML parser factory utilities (DocumentBuilderFactoryUtils, XMLInputFactoryUtils, TransformerFactoryUtils) that disable external entity processing. This fix was already included in the upstream release 4.1.4 that TuxCare onboarded (commit 0f532372). The utilities are widely used throughout the codebase in all XML parsing entry points (DomPoxMessageFactory, AxiomSoapMessageFactory, etc.), and no insecure direct factory instantiations exist in production code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.4; >= 3.0.0, < 3.0.6), Snyk (< 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE; < 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3773"
      },
      "impact_statement": "CVE-2019-3773 (XXE vulnerability in Spring Web Services) is NOT present in the target version 4.1.4-tuxcare.4. The upstream vendor (Spring/Pivotal) fixed this vulnerability in commit 1f05307d6 by introducing secure XML parser factory utilities (DocumentBuilderFactoryUtils, XMLInputFactoryUtils, TransformerFactoryUtils) that disable external entity processing. This fix was already included in the upstream release 4.1.4 that TuxCare onboarded (commit 0f532372). The utilities are widely used throughout the codebase in all XML parsing entry points (DomPoxMessageFactory, AxiomSoapMessageFactory, etc.), and no insecure direct factory instantiations exist in production code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.4; >= 3.0.0, < 3.0.6), Snyk (< 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE; < 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-xml@4.1.4-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-xml@4.1.4-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-12T10:58:00.051966+00:00",
      "status_notes": "Vulnerability CVE-2026-40998 does not affect version 4.1.4-tuxcare.2 of org.springframework.ws:spring-xml. Version 4.1.4 is not vulnerable to CVE-2026-40998. The fix was shipped in upstream release 4.1.4, which the Spring advisory (https://spring.io/security/cve-2026-40998) lists as the fixed version (affected: 4.1.0 - 4.1.3).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40998"
      },
      "impact_statement": "Version 4.1.4 is not vulnerable to CVE-2026-40998. The fix was shipped in upstream release 4.1.4, which the Spring advisory (https://spring.io/security/cve-2026-40998) lists as the fixed version (affected: 4.1.0 - 4.1.3)."
    }
  ]
}