{
  "@id": "urn:uuid:807b93d0-7b75-4a56-a9d9-1b7f7a011486",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 47,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T17:10:00.096270+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-31T02:58:52.179201+00:00",
      "status_notes": "Vulnerability CVE-2022-22950 does not affect version 6.0.16-tuxcare.4 of org.springframework:spring-expression. not_affected \u2014 CVE-2022-22950 is not present in Spring Framework 6.0.16-tuxcare.11. The vulnerability affects older versions (5.3.0-5.3.16, 5.2.x, and earlier). The fix that adds MAX_ARRAY_ELEMENTS validation (256K threshold) to prevent DoS via large SpEL array construction was authored by upstream (Sam Brannen, sbrannen@vmware.com) and shipped in Spring Framework 6.0.16 before TuxCare onboarded this version....",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22950"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22950 is not present in Spring Framework 6.0.16-tuxcare.11. The vulnerability affects older versions (5.3.0-5.3.16, 5.2.x, and earlier). The fix that adds MAX_ARRAY_ELEMENTS validation (256K threshold) to prevent DoS via large SpEL array construction was authored by upstream (Sam Brannen, sbrannen@vmware.com) and shipped in Spring Framework 6.0.16 before TuxCare onboarded this version...."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-31T03:32:40.230160+00:00",
      "status_notes": "Vulnerability CVE-2023-20861 does not affect version 6.0.16-tuxcare.4 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20861 affects Spring Framework 6.0.0-6.0.6 (SpEL regex pattern cache DoS). Target version 6.0.16 already contains the upstream fix from commit 935c29e3dd (March 2023) which moved the pattern cache from per-OperatorMatches instance to shared parser scope. The fix was shipped in upstream release 6.0.7+, BEFORE TuxCare onboarded version 6.0.16. Verification confirms InternalSpelExpression...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20861"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20861 affects Spring Framework 6.0.0-6.0.6 (SpEL regex pattern cache DoS). Target version 6.0.16 already contains the upstream fix from commit 935c29e3dd (March 2023) which moved the pattern cache from per-OperatorMatches instance to shared parser scope. The fix was shipped in upstream release 6.0.7+, BEFORE TuxCare onboarded version 6.0.16. Verification confirms InternalSpelExpression..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-31T01:28:33.675752+00:00",
      "status_notes": "Vulnerability CVE-2023-20863 does not affect version 6.0.16-tuxcare.4 of org.springframework:spring-expression. not_affected \u2014 The target repository (Spring Framework 6.0.16) is NOT AFFECTED by CVE-2023-20863. The upstream fix that limits SpEL expression length to 10,000 characters was already present in the Spring Framework 6.0.16 release before TuxCare onboarded it. The fix is authored by Sam Brannen (sam@sambrannen.com) and is active by default through SpelParserConfiguration.DEFAULT_MAX_EXPRESSION_LENGTH. The vulne...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20863"
      },
      "impact_statement": "not_affected \u2014 The target repository (Spring Framework 6.0.16) is NOT AFFECTED by CVE-2023-20863. The upstream fix that limits SpEL expression length to 10,000 characters was already present in the Spring Framework 6.0.16 release before TuxCare onboarded it. The fix is authored by Sam Brannen (sam@sambrannen.com) and is active by default through SpelParserConfiguration.DEFAULT_MAX_EXPRESSION_LENGTH. The vulne..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-02T17:10:00.096270+00:00",
      "status_notes": "Vulnerability CVE-2024-38808 affects version 6.0.16-tuxcare.4 of org.springframework:spring-expression, and is fixed in 6.0.16-tuxcare.12.",
      "vulnerability": {
        "name": "CVE-2024-38808"
      },
      "action_statement": "Vulnerability CVE-2024-38808 affects version 6.0.16-tuxcare.4 of org.springframework:spring-expression, and is fixed in 6.0.16-tuxcare.12."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2026-41849 does not affect version 6.0.16-tuxcare.4 of org.springframework:spring-expression. Spring Framework 6.0.16 builds repeated text with the JDK's String.repeat. If the int size check in OpMultiply overflows, String.repeat rejects the request with an OutOfMemoryError before allocating any memory, so the CVE-2026-41849 denial of service cannot occur. The vendor lists only 5.3.x as affected.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-41849"
      },
      "impact_statement": "Spring Framework 6.0.16 builds repeated text with the JDK's String.repeat. If the int size check in OpMultiply overflows, String.repeat rejects the request with an OutOfMemoryError before allocating any memory, so the CVE-2026-41849 denial of service cannot occur. The vendor lists only 5.3.x as affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41850 affects version 6.0.16-tuxcare.4 of org.springframework:spring-expression, and is fixed in 6.0.16-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-41850"
      },
      "action_statement": "Vulnerability CVE-2026-41850 affects version 6.0.16-tuxcare.4 of org.springframework:spring-expression, and is fixed in 6.0.16-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-07T16:41:15.493320+00:00",
      "status_notes": "Vulnerability CVE-2026-41851 affects version 6.0.16-tuxcare.4 of org.springframework:spring-expression, and is fixed in 6.0.16-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-41851"
      },
      "action_statement": "Vulnerability CVE-2026-41851 affects version 6.0.16-tuxcare.4 of org.springframework:spring-expression, and is fixed in 6.0.16-tuxcare.10."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41852 affects version 6.0.16-tuxcare.4 of org.springframework:spring-expression, and is fixed in 6.0.16-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-41852"
      },
      "action_statement": "Vulnerability CVE-2026-41852 affects version 6.0.16-tuxcare.4 of org.springframework:spring-expression, and is fixed in 6.0.16-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47886 affects version 6.0.16-tuxcare.4 of org.springframework:spring-expression, and is fixed in 6.0.16-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-47886"
      },
      "action_statement": "Vulnerability CVE-2026-47886 affects version 6.0.16-tuxcare.4 of org.springframework:spring-expression, and is fixed in 6.0.16-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59283 affects version 6.0.16-tuxcare.4 of org.springframework:spring-expression, and is fixed in 6.0.16-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-59283"
      },
      "action_statement": "Vulnerability CVE-2026-59283 affects version 6.0.16-tuxcare.4 of org.springframework:spring-expression, and is fixed in 6.0.16-tuxcare.6."
    }
  ]
}