{
  "@id": "urn:uuid:55efa8a0-fe48-403d-8ec5-443a9f67ab16",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 47,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T02:58:52.179201+00:00",
      "status_notes": "Vulnerability CVE-2022-22950 does not affect version 6.0.23-tuxcare.3 of org.springframework:spring-expression. not_affected \u2014 The target (Spring Framework 6.0.23-tuxcare.12) is not affected by CVE-2022-22950. The vulnerability concerns unbounded array allocation in SpEL expressions leading to DoS via memory exhaustion. The upstream fix (MAX_ARRAY_ELEMENTS limit of 256K elements + checkNumElements() validation) was already present in the 6.0.23 release that TuxCare onboarded. Fix commit 83ac65915871067c39a4fb255e0d484c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22950"
      },
      "impact_statement": "not_affected \u2014 The target (Spring Framework 6.0.23-tuxcare.12) is not affected by CVE-2022-22950. The vulnerability concerns unbounded array allocation in SpEL expressions leading to DoS via memory exhaustion. The upstream fix (MAX_ARRAY_ELEMENTS limit of 256K elements + checkNumElements() validation) was already present in the 6.0.23 release that TuxCare onboarded. Fix commit 83ac65915871067c39a4fb255e0d484c..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T03:32:03.250091+00:00",
      "status_notes": "Vulnerability CVE-2023-20861 does not affect version 6.0.23-tuxcare.3 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 6.0.23 is not affected by CVE-2023-20861. The upstream fix (commit 935c29e3ddba5b19951e54f6685c70ed45d9cbe5 by Sam Brannen) that shares the regex pattern cache across all SpEL `matches` operations was already included in the upstream 6.0.23 release. Additionally, 6.0.23 is well beyond the CVE's stated affected range of 6.0.0 - 6.0.6. The fix includes: (1) shared ConcurrentLruCa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20861"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.23 is not affected by CVE-2023-20861. The upstream fix (commit 935c29e3ddba5b19951e54f6685c70ed45d9cbe5 by Sam Brannen) that shares the regex pattern cache across all SpEL `matches` operations was already included in the upstream 6.0.23 release. Additionally, 6.0.23 is well beyond the CVE's stated affected range of 6.0.0 - 6.0.6. The fix includes: (1) shared ConcurrentLruCa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T01:25:13.506661+00:00",
      "status_notes": "Vulnerability CVE-2023-20863 does not affect version 6.0.23-tuxcare.3 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20863 (SpEL expression length DoS) is NOT present in spring-framework 6.0.23-tuxcare.12. The fix was already included in the upstream Spring Framework 6.0.23 release that TuxCare onboarded. The target has the defense code that limits SpEL expression length to 10,000 characters, enforced before parsing via checkExpressionLength() in InternalSpelExpressionParser.java. Fix commit b73f5fca...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20863"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20863 (SpEL expression length DoS) is NOT present in spring-framework 6.0.23-tuxcare.12. The fix was already included in the upstream Spring Framework 6.0.23 release that TuxCare onboarded. The target has the defense code that limits SpEL expression length to 10,000 characters, enforced before parsing via checkExpressionLength() in InternalSpelExpressionParser.java. Fix commit b73f5fca..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T00:20:14.191504+00:00",
      "status_notes": "Vulnerability CVE-2024-38808 does not affect version 6.0.23-tuxcare.3 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 6.0.23-tuxcare.12 is not affected by CVE-2024-38808. The vulnerability affects versions 5.3.0-5.3.38 and older. The target version 6.0.23 already contains both upstream fixes (assignment operator defense and array construction defense) that were shipped in the upstream 6.0.x release before TuxCare's onboarding. The vulnerable code patterns are not present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38808"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.23-tuxcare.12 is not affected by CVE-2024-38808. The vulnerability affects versions 5.3.0-5.3.38 and older. The target version 6.0.23 already contains both upstream fixes (assignment operator defense and array construction defense) that were shipped in the upstream 6.0.x release before TuxCare's onboarding. The vulnerable code patterns are not present in the target."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2026-41849 does not affect version 6.0.23-tuxcare.3 of org.springframework:spring-expression. Spring Framework 6.0.23 builds repeated text with the JDK's String.repeat. If the int size check in OpMultiply overflows, String.repeat rejects the request with an OutOfMemoryError before allocating any memory, so the CVE-2026-41849 denial of service cannot occur. The vendor lists only 5.3.x as affected.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-41849"
      },
      "impact_statement": "Spring Framework 6.0.23 builds repeated text with the JDK's String.repeat. If the int size check in OpMultiply overflows, String.repeat rejects the request with an OutOfMemoryError before allocating any memory, so the CVE-2026-41849 denial of service cannot occur. The vendor lists only 5.3.x as affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-06T10:15:30.574083+00:00",
      "status_notes": "Vulnerability CVE-2026-41850 affects version 6.0.23-tuxcare.3 of org.springframework:spring-expression, and is fixed in 6.0.23-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2026-41850"
      },
      "action_statement": "Vulnerability CVE-2026-41850 affects version 6.0.23-tuxcare.3 of org.springframework:spring-expression, and is fixed in 6.0.23-tuxcare.11."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-06T10:15:30.574083+00:00",
      "status_notes": "Vulnerability CVE-2026-41851 affects version 6.0.23-tuxcare.3 of org.springframework:spring-expression, and is fixed in 6.0.23-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2026-41851"
      },
      "action_statement": "Vulnerability CVE-2026-41851 affects version 6.0.23-tuxcare.3 of org.springframework:spring-expression, and is fixed in 6.0.23-tuxcare.11."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41852 affects version 6.0.23-tuxcare.3 of org.springframework:spring-expression, and is fixed in 6.0.23-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-41852"
      },
      "action_statement": "Vulnerability CVE-2026-41852 affects version 6.0.23-tuxcare.3 of org.springframework:spring-expression, and is fixed in 6.0.23-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47886 affects version 6.0.23-tuxcare.3 of org.springframework:spring-expression, and is fixed in 6.0.23-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-47886"
      },
      "action_statement": "Vulnerability CVE-2026-47886 affects version 6.0.23-tuxcare.3 of org.springframework:spring-expression, and is fixed in 6.0.23-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59283 affects version 6.0.23-tuxcare.3 of org.springframework:spring-expression, and is fixed in 6.0.23-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-59283"
      },
      "action_statement": "Vulnerability CVE-2026-59283 affects version 6.0.23-tuxcare.3 of org.springframework:spring-expression, and is fixed in 6.0.23-tuxcare.7."
    }
  ]
}