{ "@id": "urn:uuid:178063af-5e09-4ff6-8e22-581d3cf718bf", "role": "Document Creator", "author": "https://tuxcare.com", "version": 45, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T18:14:00.042564+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-11-03T13:06:45.482707+00:00", "status_notes": "Vulnerability CVE-2020-5397 does not affect version 5.3.19-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 CVE-2020-5397 affects Spring Framework 5.2.x prior to 5.2.3. The target repository is Spring Framework 5.3.19-tuxcare.3. All components of the security fix are present in the target code: (1) CorsUtils.isPreFlightRequest() properly requires Origin header in both servlet and reactive implementations, and (2) AbstractHandlerMapping routes all preflight requests through PreFlightHandler for proper...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-5397" }, "impact_statement": "not_affected \u2014 CVE-2020-5397 affects Spring Framework 5.2.x prior to 5.2.3. The target repository is Spring Framework 5.3.19-tuxcare.3. All components of the security fix are present in the target code: (1) CorsUtils.isPreFlightRequest() properly requires Origin header in both servlet and reactive implementations, and (2) AbstractHandlerMapping routes all preflight requests through PreFlightHandler for proper..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-11-06T18:14:00.042564+00:00", "status_notes": "Vulnerability CVE-2020-5398 does not affect version 5.3.19-tuxcare.3 of org.springframework:spring-webflux. Prechecker: The upstream fix is already in this version's source history (commits 41f40c6c, 956ffe68). Version 5.3.19 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-8wx2-9q48-vm9r (affected up to 5.2.3.RELEASE), NVD (affected up to 5.2.3), CVE record (affected up to 5.2.3.RELEASE), Snyk (affected up to 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-5398" }, "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 41f40c6c, 956ffe68). Version 5.3.19 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-8wx2-9q48-vm9r (affected up to 5.2.3.RELEASE), NVD (affected up to 5.2.3), CVE record (affected up to 5.2.3.RELEASE), Snyk (affected up to 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-10-30T08:55:17.845672+00:00", "status_notes": "Vulnerability CVE-2022-22965 does not affect version 5.3.19-tuxcare.3 of org.springframework:spring-webflux. Spring Framework 5.3.19 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22965" }, "impact_statement": "Spring Framework 5.3.19 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-10-27T11:54:47.755813+00:00", "status_notes": "Vulnerability CVE-2024-38816 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux.", "vulnerability": { "name": "CVE-2024-38816" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-10-27T11:54:47.755813+00:00", "status_notes": "Vulnerability CVE-2024-38819 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux.", "vulnerability": { "name": "CVE-2024-38819" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-10-27T11:54:47.755813+00:00", "status_notes": "Vulnerability CVE-2026-22735 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux.", "vulnerability": { "name": "CVE-2026-22735" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-10-27T11:54:47.755813+00:00", "status_notes": "Vulnerability CVE-2026-22737 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux.", "vulnerability": { "name": "CVE-2026-22737" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-11-05T13:17:54.024108+00:00", "status_notes": "Vulnerability CVE-2026-22740 affects version 5.3.19-tuxcare.3 of org.springframework:spring-webflux, and is fixed in 5.3.19-tuxcare.4.", "vulnerability": { "name": "CVE-2026-22740" }, "action_statement": "Vulnerability CVE-2026-22740 affects version 5.3.19-tuxcare.3 of org.springframework:spring-webflux, and is fixed in 5.3.19-tuxcare.4." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-10-27T11:54:47.755813+00:00", "status_notes": "Vulnerability CVE-2026-22741 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux.", "vulnerability": { "name": "CVE-2026-22741" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-10-27T11:54:47.755813+00:00", "status_notes": "Vulnerability CVE-2026-22745 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux.", "vulnerability": { "name": "CVE-2026-22745" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-10-27T11:54:47.755813+00:00", "status_notes": "Vulnerability CVE-2026-41839 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux.", "vulnerability": { "name": "CVE-2026-41839" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-10-27T11:54:47.755813+00:00", "status_notes": "Vulnerability CVE-2026-41840 affects version 5.3.19-tuxcare.3 of org.springframework:spring-webflux.", "vulnerability": { "name": "CVE-2026-41840" }, "action_statement": "Vulnerability CVE-2026-41840 affects version 5.3.19-tuxcare.3 of org.springframework:spring-webflux." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-10-27T11:54:47.755813+00:00", "status_notes": "Vulnerability CVE-2026-41841 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux.", "vulnerability": { "name": "CVE-2026-41841" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-10-27T11:54:47.755813+00:00", "status_notes": "Vulnerability CVE-2026-41842 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux.", "vulnerability": { "name": "CVE-2026-41842" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-10-27T11:55:00.109232+00:00", "status_notes": "Vulnerability CVE-2026-41843 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux.", "vulnerability": { "name": "CVE-2026-41843" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-10-27T11:54:47.755813+00:00", "status_notes": "Vulnerability CVE-2026-41844 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux.", "vulnerability": { "name": "CVE-2026-41844" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-10-27T11:54:47.755813+00:00", "status_notes": "Vulnerability CVE-2026-41847 does not affect version 5.3.19-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.3.19 is not affected by CVE-2026-41847. The vulnerability (filter parameter shadowing in Kotlin Router DSL) was fixed upstream in April 2021 by contributor shindong.lee@riiid.co (commit 07ba95739b). This fix was included in Spring 5.3.19 when it was released in April 2022, over a year after the fix. TuxCare onboarded the already-fixed upstream version in September 2026. Both ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41847" }, "impact_statement": "not_affected \u2014 Spring Framework 5.3.19 is not affected by CVE-2026-41847. The vulnerability (filter parameter shadowing in Kotlin Router DSL) was fixed upstream in April 2021 by contributor shindong.lee@riiid.co (commit 07ba95739b). This fix was included in Spring 5.3.19 when it was released in April 2022, over a year after the fix. TuxCare onboarded the already-fixed upstream version in September 2026. Both ..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-10-27T11:54:47.755813+00:00", "status_notes": "Vulnerability CVE-2026-41853 affects version 5.3.19-tuxcare.3 of org.springframework:spring-webflux.", "vulnerability": { "name": "CVE-2026-41853" }, "action_statement": "Vulnerability CVE-2026-41853 affects version 5.3.19-tuxcare.3 of org.springframework:spring-webflux." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-10-29T11:38:21.198900+00:00", "status_notes": "Vulnerability CVE-2026-47883 does not affect version 5.3.19-tuxcare.3 of org.springframework:spring-webflux. not_affected \u2014 Spring Framework 5.3.19 is not affected by CVE-2026-47883. The vulnerable component UrlHandlerFilter does not exist in this version - it was introduced later in Spring Framework 6.2.0-M2 (May 2024, commit edb6bb717d). The target version predates this feature by a significant margin. No alternative code path in 5.3.19 implements the same vulnerability pattern of reading request URIs with double-...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47883" }, "impact_statement": "not_affected \u2014 Spring Framework 5.3.19 is not affected by CVE-2026-47883. The vulnerable component UrlHandlerFilter does not exist in this version - it was introduced later in Spring Framework 6.2.0-M2 (May 2024, commit edb6bb717d). The target version predates this feature by a significant margin. No alternative code path in 5.3.19 implements the same vulnerability pattern of reading request URIs with double-..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-10-27T11:54:47.755813+00:00", "status_notes": "Vulnerability CVE-2026-47890 does not affect version 5.3.19-tuxcare.3 of org.springframework:spring-webflux. Spring Framework 5.3.19 is not affected by CVE-2026-47890. The vulnerability is specific to the SSE Fragment rendering feature introduced in version 6.2.0+ (July 2024). This feature does not exist in 5.3.19. The vulnerable code pattern (Fragment HTML rendering with incorrect CRLF handling using text.replace(\"\\n\", \"\\ndata:\")) is absent. Existing SSE code in ServerSentEventHttpMessageWriter already has correct CRLF handling via character-by-character escaping.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47890" }, "impact_statement": "Spring Framework 5.3.19 is not affected by CVE-2026-47890. The vulnerability is specific to the SSE Fragment rendering feature introduced in version 6.2.0+ (July 2024). This feature does not exist in 5.3.19. The vulnerable code pattern (Fragment HTML rendering with incorrect CRLF handling using text.replace(\"\\n\", \"\\ndata:\")) is absent. Existing SSE code in ServerSentEventHttpMessageWriter already has correct CRLF handling via character-by-character escaping." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-10-27T11:54:47.755813+00:00", "status_notes": "Vulnerability CVE-2026-47891 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux.", "vulnerability": { "name": "CVE-2026-47891" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-10-27T11:54:47.755813+00:00", "status_notes": "Vulnerability CVE-2026-47892 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux.", "vulnerability": { "name": "CVE-2026-47892" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webflux@5.3.19-tuxcare.3" } } ], "timestamp": "2026-10-27T11:54:47.755813+00:00", "status_notes": "Vulnerability CVE-2026-47893 is fixed in version 5.3.19-tuxcare.3 of org.springframework:spring-webflux.", "vulnerability": { "name": "CVE-2026-47893" } } ] }