{
  "@id": "urn:uuid:3061a864-1270-4c29-a6eb-96a0cfbbea52",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 41,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.19-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.19-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T03:05:11.823906+00:00",
      "status_notes": "Vulnerability CVE-2022-22950 does not affect version 6.2.19-tuxcare.1 of org.springframework:spring-expression. not_affected \u2014 CVE-2022-22950 affects Spring Framework 5.3.0-5.3.16, 5.2.0-5.2.19, and older versions. The target is Spring Framework 6.2.19, which already contains the upstream fix introduced in version 5.3.17 (March 2022). The fix adds MAX_ARRAY_ELEMENTS threshold (256K) and checkNumElements() validation to prevent DoS via large SpEL array construction. The vulnerable pattern is not present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22950"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22950 affects Spring Framework 5.3.0-5.3.16, 5.2.0-5.2.19, and older versions. The target is Spring Framework 6.2.19, which already contains the upstream fix introduced in version 5.3.17 (March 2022). The fix adds MAX_ARRAY_ELEMENTS threshold (256K) and checkNumElements() validation to prevent DoS via large SpEL array construction. The vulnerable pattern is not present in the target."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.19-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.19-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T03:38:32.216996+00:00",
      "status_notes": "Vulnerability CVE-2023-20861 does not affect version 6.2.19-tuxcare.1 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 6.2.19-tuxcare.3 is not affected by CVE-2023-20861. The vulnerability (inefficient regex pattern caching in SpEL matches operator leading to DoS) was fixed by upstream commit 935c29e3 (March 2023) by Sam Brannen, which moved the pattern cache from per-OperatorMatches-instance scope to shared parser-level scope. This fix was already present in the upstream 6.2.19 release that Tu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20861"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.19-tuxcare.3 is not affected by CVE-2023-20861. The vulnerability (inefficient regex pattern caching in SpEL matches operator leading to DoS) was fixed by upstream commit 935c29e3 (March 2023) by Sam Brannen, which moved the pattern cache from per-OperatorMatches-instance scope to shared parser-level scope. This fix was already present in the upstream 6.2.19 release that Tu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.19-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.19-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T01:31:16.482147+00:00",
      "status_notes": "Vulnerability CVE-2023-20863 does not affect version 6.2.19-tuxcare.1 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20863 affects Spring Framework versions prior to 5.2.24, 5.3.27, and 6.0.8. The target repository is version 6.2.19, which already contains the upstream fix that limits SpEL expression length to prevent DoS attacks. The fix (commit b73f5fcac2) was authored by upstream Spring maintainer sam@sambrannen.com and was present in the upstream 6.2.19 release before TuxCare onboarded it. The vu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20863"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20863 affects Spring Framework versions prior to 5.2.24, 5.3.27, and 6.0.8. The target repository is version 6.2.19, which already contains the upstream fix that limits SpEL expression length to prevent DoS attacks. The fix (commit b73f5fcac2) was authored by upstream Spring maintainer sam@sambrannen.com and was present in the upstream 6.2.19 release before TuxCare onboarded it. The vu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.19-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.19-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T00:27:08.665079+00:00",
      "status_notes": "Vulnerability CVE-2024-38808 does not affect version 6.2.19-tuxcare.1 of org.springframework:spring-expression. not_affected \u2014 The target Spring Framework 6.2.19 is NOT affected by CVE-2024-38808. Both security fixes (assignment operator restrictions and array construction guards) were already present in the upstream Spring Framework 6.2.19 release (June 2026) before TuxCare onboarded it. The fixes were authored by upstream Spring developers (Sam Brannen and Juergen Hoeller) in August 2024 and October 2022 respectively...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38808"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 6.2.19 is NOT affected by CVE-2024-38808. Both security fixes (assignment operator restrictions and array construction guards) were already present in the upstream Spring Framework 6.2.19 release (June 2026) before TuxCare onboarded it. The fixes were authored by upstream Spring developers (Sam Brannen and Juergen Hoeller) in August 2024 and October 2022 respectively..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.19-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.19-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2026-41849 does not affect version 6.2.19-tuxcare.1 of org.springframework:spring-expression. Spring Framework 6.2.19 already contains the fix for CVE-2026-41849: OpMultiply computes the repeated text size with long arithmetic, so the 256-character limit cannot be bypassed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41849"
      },
      "impact_statement": "Spring Framework 6.2.19 already contains the fix for CVE-2026-41849: OpMultiply computes the repeated text size with long arithmetic, so the 256-character limit cannot be bypassed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.19-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.19-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41850 does not affect version 6.2.19-tuxcare.1 of org.springframework:spring-expression. The affected range ends at 6.2.18; Spring Framework 6.2.19 is not affected.",
      "vulnerability": {
        "name": "CVE-2026-41850"
      },
      "impact_statement": "The affected range ends at 6.2.18; Spring Framework 6.2.19 is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.19-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.19-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41851 does not affect version 6.2.19-tuxcare.1 of org.springframework:spring-expression. The affected range ends at 6.2.18; Spring Framework 6.2.19 is not affected.",
      "vulnerability": {
        "name": "CVE-2026-41851"
      },
      "impact_statement": "The affected range ends at 6.2.18; Spring Framework 6.2.19 is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.19-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.19-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41852 does not affect version 6.2.19-tuxcare.1 of org.springframework:spring-expression. The affected range ends at 6.2.18; Spring Framework 6.2.19 is not affected.",
      "vulnerability": {
        "name": "CVE-2026-41852"
      },
      "impact_statement": "The affected range ends at 6.2.18; Spring Framework 6.2.19 is not affected."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.19-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.19-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47886 is fixed in version 6.2.19-tuxcare.1 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-47886"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.19-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.19-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59283 is fixed in version 6.2.19-tuxcare.1 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-59283"
      }
    }
  ]
}