{ "@id": "urn:uuid:fca00362-c242-4145-bce7-77b1aab0c61b", "role": "Document Creator", "author": "https://tuxcare.com", "version": 47, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-05T14:17:00.037131+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3" } } ], "timestamp": "2026-10-30T16:52:00.226722+00:00", "status_notes": "Vulnerability CVE-2013-6429 does not affect version 6.2.1-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6429 (XXE in SourceHttpMessageConverter) is NOT present in Spring Framework 6.2.1-tuxcare.6. The upstream fix (commit 2ae6a6a341 by Rossen Stoyanchev, Nov 2013) was already included in the Spring Framework 6.2.1 release that TuxCare onboarded. The code contains comprehensive XXE defenses: processExternalEntities defaults to false, XML parser security features are explicitly set to disa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2013-6429" }, "impact_statement": "not_affected \u2014 CVE-2013-6429 (XXE in SourceHttpMessageConverter) is NOT present in Spring Framework 6.2.1-tuxcare.6. The upstream fix (commit 2ae6a6a341 by Rossen Stoyanchev, Nov 2013) was already included in the Spring Framework 6.2.1 release that TuxCare onboarded. The code contains comprehensive XXE defenses: processExternalEntities defaults to false, XML parser security features are explicitly set to disa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3" } } ], "timestamp": "2026-10-30T11:23:51.256661+00:00", "status_notes": "Vulnerability CVE-2013-6430 does not affect version 6.2.1-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430: Spring Framework 6.2.1-tuxcare.6 is NOT AFFECTED. The vulnerability requires missing escaping of four special characters (<, >, \\u2028, \\u2029) in JavaScriptUtils.javaScriptEscape(). The target contains the complete fix at lines 79-92 of JavaScriptUtils.java, escaping all four characters to their Unicode representations. This fix was authored by upstream Spring developer Rossen S...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2013-6430" }, "impact_statement": "not_affected \u2014 CVE-2013-6430: Spring Framework 6.2.1-tuxcare.6 is NOT AFFECTED. The vulnerability requires missing escaping of four special characters (<, >, \\u2028, \\u2029) in JavaScriptUtils.javaScriptEscape(). The target contains the complete fix at lines 79-92 of JavaScriptUtils.java, escaping all four characters to their Unicode representations. This fix was authored by upstream Spring developer Rossen S..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3" } } ], "timestamp": "2026-10-30T06:34:00.172309+00:00", "status_notes": "Vulnerability CVE-2015-3192 does not affect version 6.2.1-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.2.1 is not affected by CVE-2015-3192 (DTD-based memory exhaustion DoS). The upstream vendor (Pivotal/VMware) already fixed this vulnerability in commit d79ec68db4 on 2015-06-30, which was included in the upstream release before TuxCare onboarded version 6.2.1. The fix adds comprehensive DTD protection across all XML parsing paths by disabling DTD processing by default (suppor...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-3192" }, "impact_statement": "not_affected \u2014 Spring Framework 6.2.1 is not affected by CVE-2015-3192 (DTD-based memory exhaustion DoS). The upstream vendor (Pivotal/VMware) already fixed this vulnerability in commit d79ec68db4 on 2015-06-30, which was included in the upstream release before TuxCare onboarded version 6.2.1. The fix adds comprehensive DTD protection across all XML parsing paths by disabling DTD processing by default (suppor..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3" } } ], "timestamp": "2026-11-03T12:09:40.812233+00:00", "status_notes": "Vulnerability CVE-2016-1000027 does not affect version 6.2.1-tuxcare.3 of org.springframework:spring-web. Spring Framework 6.2.1 is not affected by CVE-2016-1000027. The vulnerable HTTP invoker and remoting classes (HttpInvokerServiceExporter, HttpInvokerProxyFactoryBean, SimpleHttpInvokerServiceExporter, etc.) were completely removed in upstream Spring Framework 6.0.0 (commit 5822f1bf85, September 2021). The target version 6.2.1 inherited this removal from the upstream release. Exhaustive searches confirm no HTTP invoker classes exist in the codebase. This is an upstream vendor fix that shipped in the v6.0.0 release, predating TuxCare's onboarding of version 6.2.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.0), NVD (< 6.0.0), Snyk (<= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-1000027" }, "impact_statement": "Spring Framework 6.2.1 is not affected by CVE-2016-1000027. The vulnerable HTTP invoker and remoting classes (HttpInvokerServiceExporter, HttpInvokerProxyFactoryBean, SimpleHttpInvokerServiceExporter, etc.) were completely removed in upstream Spring Framework 6.0.0 (commit 5822f1bf85, September 2021). The target version 6.2.1 inherited this removal from the upstream release. Exhaustive searches confirm no HTTP invoker classes exist in the codebase. This is an upstream vendor fix that shipped in the v6.0.0 release, predating TuxCare's onboarding of version 6.2.1.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.0), NVD (< 6.0.0), Snyk (<= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3" } } ], "timestamp": "2026-11-03T00:25:21.087511+00:00", "status_notes": "Vulnerability CVE-2018-11039 does not affect version 6.2.1-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 CVE-2018-11039 is NOT present in Spring Framework 6.2.1-tuxcare.6. The vulnerability allowed arbitrary HTTP method override via the `_method` parameter (including TRACE for XST attacks). Both HiddenHttpMethodFilter variants (servlet and reactive) contain the upstream fix: an ALLOWED_METHODS whitelist restricting `_method` to PUT, DELETE, PATCH. The fix was authored by Brian Clozel (bclozel@pivo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2018-11039" }, "impact_statement": "not_affected \u2014 CVE-2018-11039 is NOT present in Spring Framework 6.2.1-tuxcare.6. The vulnerability allowed arbitrary HTTP method override via the `_method` parameter (including TRACE for XST attacks). Both HiddenHttpMethodFilter variants (servlet and reactive) contain the upstream fix: an ALLOWED_METHODS whitelist restricting `_method` to PUT, DELETE, PATCH. The fix was authored by Brian Clozel (bclozel@pivo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3" } } ], "timestamp": "2026-11-04T09:17:29.431970+00:00", "status_notes": "Vulnerability CVE-2021-22118 does not affect version 6.2.1-tuxcare.3 of org.springframework:spring-web. CVE-2021-22118 is NOT present in Spring Framework 6.2.1. The vulnerability involved predictable temporary directory paths (e.g., java.io.tmpdir/spring-multipart) that allowed locally authenticated attackers to recreate directories and gain unauthorized access to uploaded files. The upstream fix (commit 0d0d75e25322 by apoutsma@pivotal.io) replaced these with randomly-generated temporary directories using Files.createTempDirectory(). This fix was released in Spring Framework 5.3.7 (May 2021) and is present in version 6.2.1, which shipped with the fix already applied before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-22118" }, "impact_statement": "CVE-2021-22118 is NOT present in Spring Framework 6.2.1. The vulnerability involved predictable temporary directory paths (e.g., java.io.tmpdir/spring-multipart) that allowed locally authenticated attackers to recreate directories and gain unauthorized access to uploaded files. The upstream fix (commit 0d0d75e25322 by apoutsma@pivotal.io) replaced these with randomly-generated temporary directories using Files.createTempDirectory(). This fix was released in Spring Framework 5.3.7 (May 2021) and is present in version 6.2.1, which shipped with the fix already applied before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3" } } ], "timestamp": "2026-11-03T12:42:09.520685+00:00", "status_notes": "Vulnerability CVE-2024-22243 does not affect version 6.2.1-tuxcare.3 of org.springframework:spring-web. Spring Framework 6.2.1 is NOT affected by CVE-2024-22243. The vulnerability exists in versions using regex-based URI parsing (5.x, 6.1.x) where the USERINFO_PATTERN regex incorrectly excluded '[' characters, causing parsing confusion that could allow attackers to bypass host validation. Version 6.2.1 uses a completely different architecture: a state machine parser (RfcUriParser.java) introduced in commit 52805da733 on October 1, 2024, which enforces RFC 3986 strictly and rejects URLs with '[' in non-IPv6 contexts. The upstream v6.2.1 release (December 12, 2024) was published 10 months after CVE-2024-22243 was patched (February 9, 2024), and the architectural refactor that provides protection was already included in that release before TuxCare onboarded it (August 12, 2026).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.4; >= 6.0.0, < 6.0.17; >= 5.3.0, < 5.3.32; <= 5.2.25.RELEASE), cve.org (>= 6.0.x, < 6.0.17; >= 6.1.x, < 6.1.4; >= 5.3.x, < 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4; >= 5.3.0, < 5.3.32), Snyk (< 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-22243" }, "impact_statement": "Spring Framework 6.2.1 is NOT affected by CVE-2024-22243. The vulnerability exists in versions using regex-based URI parsing (5.x, 6.1.x) where the USERINFO_PATTERN regex incorrectly excluded '[' characters, causing parsing confusion that could allow attackers to bypass host validation. Version 6.2.1 uses a completely different architecture: a state machine parser (RfcUriParser.java) introduced in commit 52805da733 on October 1, 2024, which enforces RFC 3986 strictly and rejects URLs with '[' in non-IPv6 contexts. The upstream v6.2.1 release (December 12, 2024) was published 10 months after CVE-2024-22243 was patched (February 9, 2024), and the architectural refactor that provides protection was already included in that release before TuxCare onboarded it (August 12, 2026).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.4; >= 6.0.0, < 6.0.17; >= 5.3.0, < 5.3.32; <= 5.2.25.RELEASE), cve.org (>= 6.0.x, < 6.0.17; >= 6.1.x, < 6.1.4; >= 5.3.x, < 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4; >= 5.3.0, < 5.3.32), Snyk (< 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3" } } ], "timestamp": "2026-10-28T21:22:31.131193+00:00", "status_notes": "Vulnerability CVE-2024-22259 affects version 6.2.1-tuxcare.3 of org.springframework:spring-web.", "vulnerability": { "name": "CVE-2024-22259" }, "action_statement": "Vulnerability CVE-2024-22259 affects version 6.2.1-tuxcare.3 of org.springframework:spring-web." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3" } } ], "timestamp": "2026-11-03T12:57:15.327260+00:00", "status_notes": "Vulnerability CVE-2024-22262 does not affect version 6.2.1-tuxcare.3 of org.springframework:spring-web. Spring Framework version 6.2.1 is not affected by CVE-2024-22262. The vulnerable regex-based URI parser that lacked backslash escaping was completely removed from the codebase in October 2024 (commit 6c62965cbb) and replaced with new RFC 3986 and WhatWG-compliant parsers (RfcUriParser and WhatWgUrlParser). Both new parsers have built-in character validation that rejects or properly handles backslashes, preventing the host validation bypass vulnerability. The architectural refactoring was completed by upstream Spring Framework developers and shipped in the official 6.2.1 release, which TuxCare then onboarded. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6), cve.org (>= 6.1.x, < 6.1.6; >= 6.0.x, < 6.0.19; >= 5.3.x, < 5.3.34; >= 6.1.0, < 6.1.6; >= 6.0.0, < 6.0.19; >= 5.3.0, < 5.3.34), Snyk (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-22262" }, "impact_statement": "Spring Framework version 6.2.1 is not affected by CVE-2024-22262. The vulnerable regex-based URI parser that lacked backslash escaping was completely removed from the codebase in October 2024 (commit 6c62965cbb) and replaced with new RFC 3986 and WhatWG-compliant parsers (RfcUriParser and WhatWgUrlParser). Both new parsers have built-in character validation that rejects or properly handles backslashes, preventing the host validation bypass vulnerability. The architectural refactoring was completed by upstream Spring Framework developers and shipped in the official 6.2.1 release, which TuxCare then onboarded. The vulnerable code pattern does not exist in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6), cve.org (>= 6.1.x, < 6.1.6; >= 6.0.x, < 6.0.19; >= 5.3.x, < 5.3.34; >= 6.1.0, < 6.1.6; >= 6.0.0, < 6.0.19; >= 5.3.0, < 5.3.34), Snyk (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3" } } ], "timestamp": "2026-10-30T02:38:31.093612+00:00", "status_notes": "Vulnerability CVE-2024-38809 does not affect version 6.2.1-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.2.1 is not affected by CVE-2024-38809. The vulnerable regex-based ETag parsing pattern has been replaced with an efficient character-by-character state machine in the upstream Spring Framework 6.2.1 release (commit bb17ad8314 by rossen.stoyanchev@broadcom.com). This fix was already present when TuxCare onboarded version 6.2.1, making the vulnerable code pattern absent from th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-38809" }, "impact_statement": "not_affected \u2014 Spring Framework 6.2.1 is not affected by CVE-2024-38809. The vulnerable regex-based ETag parsing pattern has been replaced with an efficient character-by-character state machine in the upstream Spring Framework 6.2.1 release (commit bb17ad8314 by rossen.stoyanchev@broadcom.com). This fix was already present when TuxCare onboarded version 6.2.1, making the vulnerable code pattern absent from th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3" } } ], "timestamp": "2026-11-05T14:17:00.037131+00:00", "status_notes": "Vulnerability CVE-2024-38820 does not affect version 6.2.1-tuxcare.3 of org.springframework:spring-web. Version 6.2.1 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-4gc7-5j7h-4qph (affected below 6.1.14), NVD (affected below 6.1.14), CVE record (affected below 6.1.14), Snyk (affected below 6.1.14).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-38820" }, "impact_statement": "Version 6.2.1 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-4gc7-5j7h-4qph (affected below 6.1.14), NVD (affected below 6.1.14), CVE record (affected below 6.1.14), Snyk (affected below 6.1.14)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-41234 is fixed in version 6.2.1-tuxcare.3 of org.springframework:spring-web.", "vulnerability": { "name": "CVE-2025-41234" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41845 is fixed in version 6.2.1-tuxcare.3 of org.springframework:spring-web.", "vulnerability": { "name": "CVE-2026-41845" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41854 is fixed in version 6.2.1-tuxcare.3 of org.springframework:spring-web.", "vulnerability": { "name": "CVE-2026-41854" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47885 affects version 6.2.1-tuxcare.3 of org.springframework:spring-web, and is fixed in 6.2.1-tuxcare.4.", "vulnerability": { "name": "CVE-2026-47885" }, "action_statement": "Vulnerability CVE-2026-47885 affects version 6.2.1-tuxcare.3 of org.springframework:spring-web, and is fixed in 6.2.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47889 affects version 6.2.1-tuxcare.3 of org.springframework:spring-web, and is fixed in 6.2.1-tuxcare.4.", "vulnerability": { "name": "CVE-2026-47889" }, "action_statement": "Vulnerability CVE-2026-47889 affects version 6.2.1-tuxcare.3 of org.springframework:spring-web, and is fixed in 6.2.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59281 affects version 6.2.1-tuxcare.3 of org.springframework:spring-web, and is fixed in 6.2.1-tuxcare.4.", "vulnerability": { "name": "CVE-2026-59281" }, "action_statement": "Vulnerability CVE-2026-59281 affects version 6.2.1-tuxcare.3 of org.springframework:spring-web, and is fixed in 6.2.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@6.2.1-tuxcare.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59314 affects version 6.2.1-tuxcare.3 of org.springframework:spring-web, and is fixed in 6.2.1-tuxcare.4.", "vulnerability": { "name": "CVE-2026-59314" }, "action_statement": "Vulnerability CVE-2026-59314 affects version 6.2.1-tuxcare.3 of org.springframework:spring-web, and is fixed in 6.2.1-tuxcare.4." } ] }