{
  "@id": "urn:uuid:fe89ac4e-20d3-4510-91e7-eb561bd7d865",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 45,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.30-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.30-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-31T02:50:24.069920+00:00",
      "status_notes": "Vulnerability CVE-2022-22950 does not affect version 5.3.30-tuxcare.5 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 5.3.30 is not affected by CVE-2022-22950. The vulnerability (SpEL expression DoS via large array allocation) was fixed in upstream version 5.3.17 by Sam Brannen. Since 5.3.30 is newer than 5.3.17, the fix was already present in the upstream release when TuxCare onboarded it. The target contains the complete mitigation: MAX_ARRAY_ELEMENTS constant (256K limit), checkNumElements(...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22950"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.30 is not affected by CVE-2022-22950. The vulnerability (SpEL expression DoS via large array allocation) was fixed in upstream version 5.3.17 by Sam Brannen. Since 5.3.30 is newer than 5.3.17, the fix was already present in the upstream release when TuxCare onboarded it. The target contains the complete mitigation: MAX_ARRAY_ELEMENTS constant (256K limit), checkNumElements(..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.30-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.30-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-31T03:25:33.224674+00:00",
      "status_notes": "Vulnerability CVE-2023-20861 does not affect version 5.3.30-tuxcare.5 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20861 concerns a DoS vulnerability in Spring Framework's SpEL expression parser caused by lack of shared pattern caching across multiple `matches` operations. The target (Spring Framework 5.3.30) is NOT affected because the upstream fix (commit 430fc25aca by Sam Brannen) was already included in the 5.3.26 release. The CVE states affected versions are 5.3.0-5.3.25; version 5.3.30 inheri...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20861"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20861 concerns a DoS vulnerability in Spring Framework's SpEL expression parser caused by lack of shared pattern caching across multiple `matches` operations. The target (Spring Framework 5.3.30) is NOT affected because the upstream fix (commit 430fc25aca by Sam Brannen) was already included in the 5.3.26 release. The CVE states affected versions are 5.3.0-5.3.25; version 5.3.30 inheri..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.30-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.30-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-31T01:18:49.870805+00:00",
      "status_notes": "Vulnerability CVE-2023-20863 does not affect version 5.3.30-tuxcare.5 of org.springframework:spring-expression. not_affected \u2014 Target version 5.3.30 is not affected by CVE-2023-20863. The vulnerability fix (SpEL expression length limit of 10,000 characters) was already present in upstream Spring Framework 5.3.27, which was released before this version. The defense code is fully implemented in HEAD, including the MAX_EXPRESSION_LENGTH constant, checkExpressionLength() validation method, and MAX_EXPRESSION_LENGTH_EXCEEDE...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20863"
      },
      "impact_statement": "not_affected \u2014 Target version 5.3.30 is not affected by CVE-2023-20863. The vulnerability fix (SpEL expression length limit of 10,000 characters) was already present in upstream Spring Framework 5.3.27, which was released before this version. The defense code is fully implemented in HEAD, including the MAX_EXPRESSION_LENGTH constant, checkExpressionLength() validation method, and MAX_EXPRESSION_LENGTH_EXCEEDE..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.30-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.30-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-38808 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2024-38808"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.30-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.30-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41849 affects version 5.3.30-tuxcare.5 of org.springframework:spring-expression, and is fixed in 5.3.30-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-41849"
      },
      "action_statement": "Vulnerability CVE-2026-41849 affects version 5.3.30-tuxcare.5 of org.springframework:spring-expression, and is fixed in 5.3.30-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.30-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.30-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41850 affects version 5.3.30-tuxcare.5 of org.springframework:spring-expression, and is fixed in 5.3.30-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-41850"
      },
      "action_statement": "Vulnerability CVE-2026-41850 affects version 5.3.30-tuxcare.5 of org.springframework:spring-expression, and is fixed in 5.3.30-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.30-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.30-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41851 affects version 5.3.30-tuxcare.5 of org.springframework:spring-expression, and is fixed in 5.3.30-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-41851"
      },
      "action_statement": "Vulnerability CVE-2026-41851 affects version 5.3.30-tuxcare.5 of org.springframework:spring-expression, and is fixed in 5.3.30-tuxcare.10."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.30-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.30-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41852 is fixed in version 5.3.30-tuxcare.5 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-41852"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.30-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.30-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47886 affects version 5.3.30-tuxcare.5 of org.springframework:spring-expression, and is fixed in 5.3.30-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2026-47886"
      },
      "action_statement": "Vulnerability CVE-2026-47886 affects version 5.3.30-tuxcare.5 of org.springframework:spring-expression, and is fixed in 5.3.30-tuxcare.11."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.30-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.30-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59283 affects version 5.3.30-tuxcare.5 of org.springframework:spring-expression, and is fixed in 5.3.30-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-59283"
      },
      "action_statement": "Vulnerability CVE-2026-59283 affects version 5.3.30-tuxcare.5 of org.springframework:spring-expression, and is fixed in 5.3.30-tuxcare.9."
    }
  ]
}