{
  "@id": "urn:uuid:2cbd08cc-68ba-44d4-b904-0dc04e5ad64a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 42,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.24-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.24-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-31T02:58:52.179201+00:00",
      "status_notes": "Vulnerability CVE-2022-22950 does not affect version 5.3.24-tuxcare.4 of org.springframework:spring-expression. not_affected \u2014 The target Spring Framework 5.3.24 is not affected by CVE-2022-22950. The fix for this vulnerability was already present in upstream Spring Framework 5.3.17 and was included when TuxCare onboarded version 5.3.24. The fix adds validation to reject SpEL array constructor expressions that specify more than 256K elements, preventing denial-of-service through memory exhaustion.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22950"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.24 is not affected by CVE-2022-22950. The fix for this vulnerability was already present in upstream Spring Framework 5.3.17 and was included when TuxCare onboarded version 5.3.24. The fix adds validation to reject SpEL array constructor expressions that specify more than 256K elements, preventing denial-of-service through memory exhaustion."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.24-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.24-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-20861 is fixed in version 5.3.24-tuxcare.4 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2023-20861"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.24-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.24-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-20863 is fixed in version 5.3.24-tuxcare.4 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2023-20863"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.24-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.24-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-38808 is fixed in version 5.3.24-tuxcare.4 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2024-38808"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.24-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.24-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41849 affects version 5.3.24-tuxcare.4 of org.springframework:spring-expression, and is fixed in 5.3.24-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-41849"
      },
      "action_statement": "Vulnerability CVE-2026-41849 affects version 5.3.24-tuxcare.4 of org.springframework:spring-expression, and is fixed in 5.3.24-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.24-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.24-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41850 affects version 5.3.24-tuxcare.4 of org.springframework:spring-expression, and is fixed in 5.3.24-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-41850"
      },
      "action_statement": "Vulnerability CVE-2026-41850 affects version 5.3.24-tuxcare.4 of org.springframework:spring-expression, and is fixed in 5.3.24-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.24-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.24-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41851 affects version 5.3.24-tuxcare.4 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-41851"
      },
      "action_statement": "Vulnerability CVE-2026-41851 affects version 5.3.24-tuxcare.4 of org.springframework:spring-expression."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.24-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.24-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41852 affects version 5.3.24-tuxcare.4 of org.springframework:spring-expression, and is fixed in 5.3.24-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-41852"
      },
      "action_statement": "Vulnerability CVE-2026-41852 affects version 5.3.24-tuxcare.4 of org.springframework:spring-expression, and is fixed in 5.3.24-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.24-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.24-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47886 affects version 5.3.24-tuxcare.4 of org.springframework:spring-expression, and is fixed in 5.3.24-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-47886"
      },
      "action_statement": "Vulnerability CVE-2026-47886 affects version 5.3.24-tuxcare.4 of org.springframework:spring-expression, and is fixed in 5.3.24-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.24-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.24-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59283 affects version 5.3.24-tuxcare.4 of org.springframework:spring-expression, and is fixed in 5.3.24-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-59283"
      },
      "action_statement": "Vulnerability CVE-2026-59283 affects version 5.3.24-tuxcare.4 of org.springframework:spring-expression, and is fixed in 5.3.24-tuxcare.7."
    }
  ]
}