{
  "@id": "urn:uuid:a9b2de50-27fb-482c-a4ac-18a631561974",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 50,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:15:51.446651+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T16:22:12.450965+00:00",
      "status_notes": "Vulnerability CVE-2013-6429 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6429 describes an XXE vulnerability in Spring Framework's SourceHttpMessageConverter (versions before 3.2.5 and 4.0.0.M1-RC1) where external entity resolution was not disabled, allowing attackers to read arbitrary files or cause DoS via crafted XML. The target repository (Spring Framework 6.2.13-tuxcare.4) contains the upstream fix commit 2ae6a6a341 from November 2013 by Rossen Stoyanc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-6429"
      },
      "impact_statement": "not_affected \u2014 CVE-2013-6429 describes an XXE vulnerability in Spring Framework's SourceHttpMessageConverter (versions before 3.2.5 and 4.0.0.M1-RC1) where external entity resolution was not disabled, allowing attackers to read arbitrary files or cause DoS via crafted XML. The target repository (Spring Framework 6.2.13-tuxcare.4) contains the upstream fix commit 2ae6a6a341 from November 2013 by Rossen Stoyanc..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T11:18:03.845506+00:00",
      "status_notes": "Vulnerability CVE-2013-6430 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 is NOT present in Spring Framework 6.2.13. The vulnerability was fixed in Spring Framework 3.2.2 (February 2013) by upstream commit f5c9fe69a4 authored by Rossen Stoyanchev. The target version 6.2.13 includes this fix, which adds Unicode escaping for angle brackets (`<`, `>`) and line/paragraph separators (`\\u2028`, `\\u2029`) in JavaScriptUtils.javaScriptEscape(). The fix was alre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-6430"
      },
      "impact_statement": "not_affected \u2014 CVE-2013-6430 is NOT present in Spring Framework 6.2.13. The vulnerability was fixed in Spring Framework 3.2.2 (February 2013) by upstream commit f5c9fe69a4 authored by Rossen Stoyanchev. The target version 6.2.13 includes this fix, which adds Unicode escaping for angle brackets (`<`, `>`) and line/paragraph separators (`\\u2028`, `\\u2029`) in JavaScriptUtils.javaScriptEscape(). The fix was alre..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T06:26:00.087741+00:00",
      "status_notes": "Vulnerability CVE-2015-3192 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2015-3192 is not present in Spring Framework 6.2.13-tuxcare.4. The upstream vendor fix (commit d79ec68db4) from 2015-06-30 that disables DTD processing by default was already included in the upstream 6.2.13 release when TuxCare onboarded it. The vulnerable code pattern (unprotected DTD processing) is not present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-3192"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-3192 is not present in Spring Framework 6.2.13-tuxcare.4. The upstream vendor fix (commit d79ec68db4) from 2015-06-30 that disables DTD processing by default was already included in the upstream 6.2.13 release when TuxCare onboarded it. The vulnerable code pattern (unprotected DTD processing) is not present."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:08:58.427102+00:00",
      "status_notes": "Vulnerability CVE-2016-1000027 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-web. Target Spring Framework version 6.2.13 is NOT affected by CVE-2016-1000027. The vulnerable HTTP Invoker classes (HttpInvokerServiceExporter, HttpInvokerProxyFactoryBean, SimpleHttpInvokerServiceExporter) that performed unsafe Java deserialization of HTTP request bodies were completely removed in Spring Framework 6.0.0 (commit 5822f1bf85, September 2021). This removal was already present in the upstream release 6.2.13 when TuxCare onboarded it. Exhaustive searches confirm no HTTP Invoker classes exist in the target repository, and no alternative HTTP deserialization mechanisms are automatically wired to endpoints.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.0), NVD (< 6.0.0), Snyk (<= 0).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2016-1000027"
      },
      "impact_statement": "Target Spring Framework version 6.2.13 is NOT affected by CVE-2016-1000027. The vulnerable HTTP Invoker classes (HttpInvokerServiceExporter, HttpInvokerProxyFactoryBean, SimpleHttpInvokerServiceExporter) that performed unsafe Java deserialization of HTTP request bodies were completely removed in Spring Framework 6.0.0 (commit 5822f1bf85, September 2021). This removal was already present in the upstream release 6.2.13 when TuxCare onboarded it. Exhaustive searches confirm no HTTP Invoker classes exist in the target repository, and no alternative HTTP deserialization mechanisms are automatically wired to endpoints.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.0), NVD (< 6.0.0), Snyk (<= 0)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T00:22:03.603968+00:00",
      "status_notes": "Vulnerability CVE-2018-11039 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.2.13-tuxcare.4 is not affected by CVE-2018-11039. The vulnerability (unrestricted HTTP method override via HiddenHttpMethodFilter allowing TRACE and other dangerous methods) was fixed in upstream Spring Framework 5.0.7/4.3.18 (May 2018). Version 6.2.13 contains the fix (ALLOWED_METHODS whitelist restricting _method parameter to PUT/DELETE/PATCH only) as it was shipped in the ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11039"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.13-tuxcare.4 is not affected by CVE-2018-11039. The vulnerability (unrestricted HTTP method override via HiddenHttpMethodFilter allowing TRACE and other dangerous methods) was fixed in upstream Spring Framework 5.0.7/4.3.18 (May 2018). Version 6.2.13 contains the fix (ALLOWED_METHODS whitelist restricting _method parameter to PUT/DELETE/PATCH only) as it was shipped in the ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:15:51.446651+00:00",
      "status_notes": "Vulnerability CVE-2021-22118 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-web. Spring Framework 6.2.13 is not affected by CVE-2021-22118. The upstream vendor fix for this vulnerability (randomized temporary directory names for multipart file uploads) was already present in the Spring Framework release that TuxCare onboarded. The vulnerable pattern (predictable temp directory paths like \"spring-multipart\") has been replaced with randomized directories using Files.createTempDirectory(), preventing attackers from manipulating the temp directory to intercept or modify uploaded files.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22118"
      },
      "impact_statement": "Spring Framework 6.2.13 is not affected by CVE-2021-22118. The upstream vendor fix for this vulnerability (randomized temporary directory names for multipart file uploads) was already present in the Spring Framework release that TuxCare onboarded. The vulnerable pattern (predictable temp directory paths like \"spring-multipart\") has been replaced with randomized directories using Files.createTempDirectory(), preventing attackers from manipulating the temp directory to intercept or modify uploaded files.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:41:38.446812+00:00",
      "status_notes": "Vulnerability CVE-2024-22243 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-web. Spring Framework 6.2.13 is NOT AFFECTED by CVE-2024-22243. The vulnerability existed in versions 4.x-6.0.x that used regex-based URL parsing with a flawed USERINFO_PATTERN. Version 6.2.0 introduced a complete architectural refactoring (commit 52805da733, 2024-10-01) replacing regex parsing with two state-machine parsers (RfcUriParser and WhatWgUrlParser) that properly handle square brackets and prevent host extraction confusion. The vulnerable regex pattern does not exist in 6.2.x, and no CVE-2024-22243 backports exist for any 6.2.x version, confirming the upstream vendor considers this version series not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.4; >= 6.0.0, < 6.0.17; >= 5.3.0, < 5.3.32; <= 5.2.25.RELEASE), cve.org (>= 6.0.x, < 6.0.17; >= 6.1.x, < 6.1.4; >= 5.3.x, < 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4; >= 5.3.0, < 5.3.32), Snyk (< 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4).",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2024-22243"
      },
      "impact_statement": "Spring Framework 6.2.13 is NOT AFFECTED by CVE-2024-22243. The vulnerability existed in versions 4.x-6.0.x that used regex-based URL parsing with a flawed USERINFO_PATTERN. Version 6.2.0 introduced a complete architectural refactoring (commit 52805da733, 2024-10-01) replacing regex parsing with two state-machine parsers (RfcUriParser and WhatWgUrlParser) that properly handle square brackets and prevent host extraction confusion. The vulnerable regex pattern does not exist in 6.2.x, and no CVE-2024-22243 backports exist for any 6.2.x version, confirming the upstream vendor considers this version series not affected.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.4; >= 6.0.0, < 6.0.17; >= 5.3.0, < 5.3.32; <= 5.2.25.RELEASE), cve.org (>= 6.0.x, < 6.0.17; >= 6.1.x, < 6.1.4; >= 5.3.x, < 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4; >= 5.3.0, < 5.3.32), Snyk (< 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:48:08.430268+00:00",
      "status_notes": "Vulnerability CVE-2024-22259 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-web. Spring Framework 6.2.13 is NOT AFFECTED by CVE-2024-22259. The vulnerable regex-based URI parsing code (USERINFO_PATTERN, HOST_IPV4_PATTERN patterns with incorrect special character handling) was completely replaced with a secure state-machine-based parser (RfcUriParser) in upstream Spring Framework 6.2. The new parser properly handles @ characters (correctly capturing user info) and validates IPv6 brackets (rejecting incomplete brackets), eliminating the open redirect/SSRF vulnerability. This architectural fix was authored by upstream Spring developer rossen.stoyanchev@broadcom.com and shipped in the upstream 6.2.13 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; < 5.3.33), NVD (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5), cve.org (>= 6.1.x, < 6.1.5; >= 6.0.x, < 6.0.18; >= 5.3.x, < 5.3.33; >= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; >= 5.3.0, < 5.3.33), Snyk (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22259"
      },
      "impact_statement": "Spring Framework 6.2.13 is NOT AFFECTED by CVE-2024-22259. The vulnerable regex-based URI parsing code (USERINFO_PATTERN, HOST_IPV4_PATTERN patterns with incorrect special character handling) was completely replaced with a secure state-machine-based parser (RfcUriParser) in upstream Spring Framework 6.2. The new parser properly handles @ characters (correctly capturing user info) and validates IPv6 brackets (rejecting incomplete brackets), eliminating the open redirect/SSRF vulnerability. This architectural fix was authored by upstream Spring developer rossen.stoyanchev@broadcom.com and shipped in the upstream 6.2.13 release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; < 5.3.33), NVD (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5), cve.org (>= 6.1.x, < 6.1.5; >= 6.0.x, < 6.0.18; >= 5.3.x, < 5.3.33; >= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; >= 5.3.0, < 5.3.33), Snyk (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:57:15.327260+00:00",
      "status_notes": "Vulnerability CVE-2024-22262 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-web. The target (Spring Framework 6.2.13-tuxcare.4) is NOT affected by CVE-2024-22262. The vulnerability exists in older Spring versions (5.x, 6.0, 6.1) that use regex-based URI parsing which failed to exclude backslash characters from authority components (scheme, userinfo, host, port), allowing URLs like http://trusted.com\\@evil.com to be misparsed, enabling host validation bypass for open redirect or SSRF attacks. Spring 6.2 introduced RfcUriParser, a complete architectural refactoring to state-machine-based parsing that validates each character against RFC 3986 character sets. Backslash (ASCII 92) is not in the unreserved set (alpha, digit, '-', '.', '_', '~') nor the sub-delimiter set ('!', '$', '&', etc.), so RfcUriParser rejects such URLs with InvalidUrlException \"Bad authority\" before any host extraction occurs. The vulnerable regex patterns (SCHEME_PATTERN, USERINFO_PATTERN, HOST_IPV4_PATTERN, PORT_PATTERN) that needed the CVE patches do not exist in the target codebase. RfcUriParser was authored by upstream Spring maintainer (rossen.stoyanchev@broadcom.com, commit bbb53d03c4f9) and shipped in Spring 6.2.0 (Nov 2024), before TuxCare onboarded 6.2.13. No TuxCare-specific backport was needed or applied for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6), cve.org (>= 6.1.x, < 6.1.6; >= 6.0.x, < 6.0.19; >= 5.3.x, < 5.3.34; >= 6.1.0, < 6.1.6; >= 6.0.0, < 6.0.19; >= 5.3.0, < 5.3.34), Snyk (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22262"
      },
      "impact_statement": "The target (Spring Framework 6.2.13-tuxcare.4) is NOT affected by CVE-2024-22262. The vulnerability exists in older Spring versions (5.x, 6.0, 6.1) that use regex-based URI parsing which failed to exclude backslash characters from authority components (scheme, userinfo, host, port), allowing URLs like http://trusted.com\\@evil.com to be misparsed, enabling host validation bypass for open redirect or SSRF attacks. Spring 6.2 introduced RfcUriParser, a complete architectural refactoring to state-machine-based parsing that validates each character against RFC 3986 character sets. Backslash (ASCII 92) is not in the unreserved set (alpha, digit, '-', '.', '_', '~') nor the sub-delimiter set ('!', '$', '&', etc.), so RfcUriParser rejects such URLs with InvalidUrlException \"Bad authority\" before any host extraction occurs. The vulnerable regex patterns (SCHEME_PATTERN, USERINFO_PATTERN, HOST_IPV4_PATTERN, PORT_PATTERN) that needed the CVE patches do not exist in the target codebase. RfcUriParser was authored by upstream Spring maintainer (rossen.stoyanchev@broadcom.com, commit bbb53d03c4f9) and shipped in Spring 6.2.0 (Nov 2024), before TuxCare onboarded 6.2.13. No TuxCare-specific backport was needed or applied for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6), cve.org (>= 6.1.x, < 6.1.6; >= 6.0.x, < 6.0.19; >= 5.3.x, < 5.3.34; >= 6.1.0, < 6.1.6; >= 6.0.0, < 6.0.19; >= 5.3.0, < 5.3.34), Snyk (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T02:37:34.631561+00:00",
      "status_notes": "Vulnerability CVE-2024-38809 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.2.13 is not affected by CVE-2024-38809. The vulnerability involved catastrophic backtracking in regex-based ETag header parsing that could cause DoS. The fix (commit bb17ad8314b81850a939fd265fb53b3361705e85) replaced the vulnerable regex pattern with a linear state-machine parser in the new ETag.java class. This fix was authored by upstream Spring maintainer rossen.stoyanchev...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38809"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.13 is not affected by CVE-2024-38809. The vulnerability involved catastrophic backtracking in regex-based ETag header parsing that could cause DoS. The fix (commit bb17ad8314b81850a939fd265fb53b3361705e85) replaced the vulnerable regex pattern with a linear state-machine parser in the new ETag.java class. This fix was authored by upstream Spring maintainer rossen.stoyanchev..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T04:01:00.086822+00:00",
      "status_notes": "Vulnerability CVE-2024-38820 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.2.13 is not affected by CVE-2024-38820. The target version uses PatternMatchUtils.simpleMatchIgnoreCase() for case-insensitive disallowed field matching, which performs locale-independent comparison via String.equalsIgnoreCase() and String.regionMatches(true, ...). The vulnerable pattern (using String.toLowerCase() without Locale.ROOT) is not present in the DataBinder impleme...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38820"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.2.13 is not affected by CVE-2024-38820. The target version uses PatternMatchUtils.simpleMatchIgnoreCase() for case-insensitive disallowed field matching, which performs locale-independent comparison via String.equalsIgnoreCase() and String.regionMatches(true, ...). The vulnerable pattern (using String.toLowerCase() without Locale.ROOT) is not present in the DataBinder impleme..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T03:48:46.502543+00:00",
      "status_notes": "Vulnerability CVE-2025-41234 does not affect version 6.2.13-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2025-41234 (reflected file download via unencoded double-quote in Content-Disposition filename) is NOT present in spring-framework 6.2.13-tuxcare.4. The fix commit f0e7b42704 by Brian Clozel (Broadcom) marking double-quote (ASCII 34) as non-printable was already included in the upstream 6.2.13 release before TuxCare onboarded it. The target code at ContentDisposition.java:71 contains `PRINT...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-41234"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-41234 (reflected file download via unencoded double-quote in Content-Disposition filename) is NOT present in spring-framework 6.2.13-tuxcare.4. The fix commit f0e7b42704 by Brian Clozel (Broadcom) marking double-quote (ASCII 34) as non-printable was already included in the upstream 6.2.13 release before TuxCare onboarded it. The target code at ContentDisposition.java:71 contains `PRINT..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41845 is fixed in version 6.2.13-tuxcare.2 of org.springframework:spring-web.",
      "vulnerability": {
        "name": "CVE-2026-41845"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41854 is fixed in version 6.2.13-tuxcare.2 of org.springframework:spring-web.",
      "vulnerability": {
        "name": "CVE-2026-41854"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47885 is fixed in version 6.2.13-tuxcare.2 of org.springframework:spring-web.",
      "vulnerability": {
        "name": "CVE-2026-47885"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47889 is fixed in version 6.2.13-tuxcare.2 of org.springframework:spring-web.",
      "vulnerability": {
        "name": "CVE-2026-47889"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59281 is fixed in version 6.2.13-tuxcare.2 of org.springframework:spring-web.",
      "vulnerability": {
        "name": "CVE-2026-59281"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@6.2.13-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59314 is fixed in version 6.2.13-tuxcare.2 of org.springframework:spring-web.",
      "vulnerability": {
        "name": "CVE-2026-59314"
      }
    }
  ]
}