{
  "@id": "urn:uuid:c1306e69-c3c6-43cd-b085-c52129b1bb43",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 44,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T02:52:16.214974+00:00",
      "status_notes": "Vulnerability CVE-2022-22950 does not affect version 5.3.27-tuxcare.2 of org.springframework:spring-expression. not_affected \u2014 CVE-2022-22950 affects Spring Framework versions 5.3.0-5.3.16. The target version 5.3.27 is not affected because the fix was already included in upstream Spring Framework 5.3.17 (released before 5.3.27). The fix adds a MAX_ARRAY_ELEMENTS threshold (256K) and validation to prevent DoS via large SpEL array construction expressions. The target repository contains the complete upstream fix: MAX_ARR...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22950"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22950 affects Spring Framework versions 5.3.0-5.3.16. The target version 5.3.27 is not affected because the fix was already included in upstream Spring Framework 5.3.17 (released before 5.3.27). The fix adds a MAX_ARRAY_ELEMENTS threshold (256K) and validation to prevent DoS via large SpEL array construction expressions. The target repository contains the complete upstream fix: MAX_ARR..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T03:26:30.015542+00:00",
      "status_notes": "Vulnerability CVE-2023-20861 does not affect version 5.3.27-tuxcare.2 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20861 is NOT present in Spring Framework 5.3.27. The fix (commit 430fc25aca by Sam Brannen, dated 2023-03-20) was already included in the upstream Spring Framework 5.3.27 release that TuxCare onboarded on 2025-07-09. The vulnerable pattern\u2014where each OperatorMatches instance maintained its own pattern cache, preventing cache sharing across multiple 'matches' operations\u2014has been replace...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20861"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20861 is NOT present in Spring Framework 5.3.27. The fix (commit 430fc25aca by Sam Brannen, dated 2023-03-20) was already included in the upstream Spring Framework 5.3.27 release that TuxCare onboarded on 2025-07-09. The vulnerable pattern\u2014where each OperatorMatches instance maintained its own pattern cache, preventing cache sharing across multiple 'matches' operations\u2014has been replace..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T01:20:19.051610+00:00",
      "status_notes": "Vulnerability CVE-2023-20863 does not affect version 5.3.27-tuxcare.2 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20863 affects Spring Framework versions prior to 5.2.24, 5.3.27, and 6.0.8 by allowing denial-of-service through excessively long SpEL expressions. The target repository (Spring Framework 5.3.27) is NOT AFFECTED because the upstream fix was already included in the 5.3.27 release that TuxCare onboarded. The fix adds expression length validation (10,000 character limit) in InternalSpelEx...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20863"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20863 affects Spring Framework versions prior to 5.2.24, 5.3.27, and 6.0.8 by allowing denial-of-service through excessively long SpEL expressions. The target repository (Spring Framework 5.3.27) is NOT AFFECTED because the upstream fix was already included in the 5.3.27 release that TuxCare onboarded. The fix adds expression length validation (10,000 character limit) in InternalSpelEx..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.2 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2024-38808"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41849 affects version 5.3.27-tuxcare.2 of org.springframework:spring-expression, and is fixed in 5.3.27-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-41849"
      },
      "action_statement": "Vulnerability CVE-2026-41849 affects version 5.3.27-tuxcare.2 of org.springframework:spring-expression, and is fixed in 5.3.27-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41850 affects version 5.3.27-tuxcare.2 of org.springframework:spring-expression, and is fixed in 5.3.27-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-41850"
      },
      "action_statement": "Vulnerability CVE-2026-41850 affects version 5.3.27-tuxcare.2 of org.springframework:spring-expression, and is fixed in 5.3.27-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.2 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-41851"
      },
      "action_statement": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.2 of org.springframework:spring-expression."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41852 affects version 5.3.27-tuxcare.2 of org.springframework:spring-expression, and is fixed in 5.3.27-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-41852"
      },
      "action_statement": "Vulnerability CVE-2026-41852 affects version 5.3.27-tuxcare.2 of org.springframework:spring-expression, and is fixed in 5.3.27-tuxcare.10."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47886 affects version 5.3.27-tuxcare.2 of org.springframework:spring-expression, and is fixed in 5.3.27-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-47886"
      },
      "action_statement": "Vulnerability CVE-2026-47886 affects version 5.3.27-tuxcare.2 of org.springframework:spring-expression, and is fixed in 5.3.27-tuxcare.10."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59283 affects version 5.3.27-tuxcare.2 of org.springframework:spring-expression, and is fixed in 5.3.27-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-59283"
      },
      "action_statement": "Vulnerability CVE-2026-59283 affects version 5.3.27-tuxcare.2 of org.springframework:spring-expression, and is fixed in 5.3.27-tuxcare.9."
    }
  ]
}