{
  "@id": "urn:uuid:64936e90-bbda-46cf-9164-5b9bacce0861",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 44,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T17:45:00.538451+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.1.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.1.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T03:00:09.428090+00:00",
      "status_notes": "Vulnerability CVE-2022-22950 does not affect version 6.1.7-tuxcare.3 of org.springframework:spring-expression. not_affected \u2014 CVE-2022-22950 (SpEL array allocation DoS) is not present in Spring Framework 6.1.7. The fix adding MAX_ARRAY_ELEMENTS validation was already included in the upstream v6.1.7 release (May 16, 2024) before TuxCare onboarded this version. The vulnerable pattern (unbounded array allocation in SpEL expressions) was fixed by upstream commit 83ac6591 authored by Sam Brannen on March 8, 2022, which add...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22950"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22950 (SpEL array allocation DoS) is not present in Spring Framework 6.1.7. The fix adding MAX_ARRAY_ELEMENTS validation was already included in the upstream v6.1.7 release (May 16, 2024) before TuxCare onboarded this version. The vulnerable pattern (unbounded array allocation in SpEL expressions) was fixed by upstream commit 83ac6591 authored by Sam Brannen on March 8, 2022, which add..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.1.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.1.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T03:32:03.250091+00:00",
      "status_notes": "Vulnerability CVE-2023-20861 does not affect version 6.1.7-tuxcare.3 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20861 affects Spring Framework 6.0.0-6.0.6, 5.3.0-5.3.25, 5.2.0-5.2.22, and older versions. The target version 6.1.7 is outside this range. The vulnerability allowed specially crafted SpEL expressions with multiple regex matches operators to cause DoS through memory exhaustion by creating unbounded pattern cache instances. The upstream fix (commit 935c29e3) consolidated pattern caches ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20861"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20861 affects Spring Framework 6.0.0-6.0.6, 5.3.0-5.3.25, 5.2.0-5.2.22, and older versions. The target version 6.1.7 is outside this range. The vulnerability allowed specially crafted SpEL expressions with multiple regex matches operators to cause DoS through memory exhaustion by creating unbounded pattern cache instances. The upstream fix (commit 935c29e3) consolidated pattern caches ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.1.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.1.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T01:23:35.997960+00:00",
      "status_notes": "Vulnerability CVE-2023-20863 does not affect version 6.1.7-tuxcare.3 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20863 (DoS via long SpEL expressions) is NOT present in Spring Framework 6.1.7. The fix was already included in the upstream 6.1.7 release. The defense code checks SpEL expression length against a 10,000-character limit before parsing begins (InternalSpelExpressionParser.checkExpressionLength, line 154-159). This protection was introduced in upstream commit 785598629abda944 by Sam Bran...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20863"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20863 (DoS via long SpEL expressions) is NOT present in Spring Framework 6.1.7. The fix was already included in the upstream 6.1.7 release. The defense code checks SpEL expression length against a 10,000-character limit before parsing begins (InternalSpelExpressionParser.checkExpressionLength, line 154-159). This protection was introduced in upstream commit 785598629abda944 by Sam Bran..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.1.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.1.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-02T17:45:00.538451+00:00",
      "status_notes": "Vulnerability CVE-2024-38808 affects version 6.1.7-tuxcare.3 of org.springframework:spring-expression, and is fixed in 6.1.7-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2024-38808"
      },
      "action_statement": "Vulnerability CVE-2024-38808 affects version 6.1.7-tuxcare.3 of org.springframework:spring-expression, and is fixed in 6.1.7-tuxcare.9."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.1.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.1.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2026-41849 does not affect version 6.1.7-tuxcare.3 of org.springframework:spring-expression. Spring Framework 6.1.7 builds repeated text with the JDK's String.repeat. If the int size check in OpMultiply overflows, String.repeat rejects the request with an OutOfMemoryError before allocating any memory, so the CVE-2026-41849 denial of service cannot occur. The vendor lists only 5.3.x as affected.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-41849"
      },
      "impact_statement": "Spring Framework 6.1.7 builds repeated text with the JDK's String.repeat. If the int size check in OpMultiply overflows, String.repeat rejects the request with an OutOfMemoryError before allocating any memory, so the CVE-2026-41849 denial of service cannot occur. The vendor lists only 5.3.x as affected."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.1.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.1.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41850 is fixed in version 6.1.7-tuxcare.3 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-41850"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.1.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.1.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-21T16:47:13.430436+00:00",
      "status_notes": "Vulnerability CVE-2026-41851 affects version 6.1.7-tuxcare.3 of org.springframework:spring-expression, and is fixed in 6.1.7-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-41851"
      },
      "action_statement": "Vulnerability CVE-2026-41851 affects version 6.1.7-tuxcare.3 of org.springframework:spring-expression, and is fixed in 6.1.7-tuxcare.8."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.1.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.1.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41852 is fixed in version 6.1.7-tuxcare.3 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-41852"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.1.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.1.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47886 is fixed in version 6.1.7-tuxcare.3 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-47886"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.1.7-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.1.7-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59283 is fixed in version 6.1.7-tuxcare.3 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-59283"
      }
    }
  ]
}