{ "@id": "urn:uuid:8f0dbf23-2e26-4bec-928c-b94cba3f1d91", "role": "Document Creator", "author": "https://tuxcare.com", "version": 59, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T09:15:51.446651+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-10-30T04:45:08.604028+00:00", "status_notes": "Vulnerability CVE-2014-0054 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc. not_affected \u2014 The target Spring Framework 5.3.39-tuxcare.23 is NOT affected by CVE-2014-0054. The XXE vulnerability fix was already present in the upstream Spring Framework 5.3.39 release that TuxCare onboarded. The fix (commit edba32b309 from 2014-02-18) disables external entity resolution by default through the processExternalEntities property and SAX feature configuration in Jaxb2RootElementHttpMessageCon...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-0054" }, "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.39-tuxcare.23 is NOT affected by CVE-2014-0054. The XXE vulnerability fix was already present in the upstream Spring Framework 5.3.39 release that TuxCare onboarded. The fix (commit edba32b309 from 2014-02-18) disables external entity resolution by default through the processExternalEntities property and SAX feature configuration in Jaxb2RootElementHttpMessageCon..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-11-03T13:20:48.274952+00:00", "status_notes": "Vulnerability CVE-2014-0225 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc. CVE-2014-0225 XXE vulnerability is not present in Spring Framework 5.3.39-tuxcare.23. The upstream vendor (Pivotal/Spring) fixed this vulnerability in May 2014 (commit 8e096ae) by installing NO_OP entity resolvers across all XML parsing components. This fix shipped in Spring 4.1.0+ and was already present in the upstream release before TuxCare started maintaining version 5.3.39. External entity processing is disabled by default (processExternalEntities=false) across Jaxb2Marshaller, AbstractMarshaller, SourceHttpMessageConverter, Jaxb2RootElementHttpMessageConverter, and StaxUtils defensive factory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-0225" }, "impact_statement": "CVE-2014-0225 XXE vulnerability is not present in Spring Framework 5.3.39-tuxcare.23. The upstream vendor (Pivotal/Spring) fixed this vulnerability in May 2014 (commit 8e096ae) by installing NO_OP entity resolvers across all XML parsing components. This fix shipped in Spring 4.1.0+ and was already present in the upstream release before TuxCare started maintaining version 5.3.39. External entity processing is disabled by default (processExternalEntities=false) across Jaxb2Marshaller, AbstractMarshaller, SourceHttpMessageConverter, Jaxb2RootElementHttpMessageConverter, and StaxUtils defensive factory.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-10-31T03:49:47.804146+00:00", "status_notes": "Vulnerability CVE-2014-1904 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 affects Spring Framework versions 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2. The target repository is at version 5.3.39-tuxcare.23, which is significantly newer than the affected versions. The upstream fix (commit 741b4b229a by Rossen Stoyanchev from Pivotal) was already present in the Spring Framework 5.x release that TuxCare onboarded. The fix applies URI path encoding via UriUt...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-1904" }, "impact_statement": "not_affected \u2014 CVE-2014-1904 affects Spring Framework versions 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2. The target repository is at version 5.3.39-tuxcare.23, which is significantly newer than the affected versions. The upstream fix (commit 741b4b229a by Rossen Stoyanchev from Pivotal) was already present in the Spring Framework 5.x release that TuxCare onboarded. The fix applies URI path encoding via UriUt..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-10-31T01:44:34.057675+00:00", "status_notes": "Vulnerability CVE-2014-3625 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 (directory traversal in Spring Framework static resource handling) is NOT present in target version 5.3.39. All security defenses from the vendor patches are already implemented: path normalization strips control characters, validation rejects \"../\" sequences and URL patterns, URL-decoding with re-validation prevents encoded traversal, and final boundary verification ensures resol...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2014-3625" }, "impact_statement": "not_affected \u2014 CVE-2014-3625 (directory traversal in Spring Framework static resource handling) is NOT present in target version 5.3.39. All security defenses from the vendor patches are already implemented: path normalization strips control characters, validation rejects \"../\" sequences and URL patterns, URL-decoding with re-validation prevents encoded traversal, and final boundary verification ensures resol..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-10-30T08:39:00.844115+00:00", "status_notes": "Vulnerability CVE-2016-9878 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 5.3.39 does not contain the vulnerable code.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-9878" }, "impact_statement": "CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 5.3.39 does not contain the vulnerable code." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-11-03T12:57:15.327260+00:00", "status_notes": "Vulnerability CVE-2020-5397 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.39-tuxcare.23 is not affected by CVE-2020-5397. The vulnerability (CSRF via CORS preflight requests due to missing Origin header validation) was fixed in the upstream Spring Framework release that this version is based on. The fix (commit bc7d010485 by S\u00e9bastien Deleuze, dated 2020-01-10) added Origin header validation to CorsUtils.isPreFlightRequest() and routes all valid ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-5397" }, "impact_statement": "not_affected \u2014 Spring Framework 5.3.39-tuxcare.23 is not affected by CVE-2020-5397. The vulnerability (CSRF via CORS preflight requests due to missing Origin header validation) was fixed in the upstream Spring Framework release that this version is based on. The fix (commit bc7d010485 by S\u00e9bastien Deleuze, dated 2020-01-10) added Origin header validation to CorsUtils.isPreFlightRequest() and routes all valid ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-11-04T09:04:11.456857+00:00", "status_notes": "Vulnerability CVE-2020-5398 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc. Spring Framework 5.3.39 is NOT affected by CVE-2020-5398 (Reflected File Download via unescaped quotes in Content-Disposition headers). The upstream fix from commit 41f40c6c (December 2019) was already included in the 5.3.39 release. The current code contains the appendName() method (lines 503-517 of ContentDisposition.java) that properly escapes quote characters and backslashes in filenames before embedding them in Content-Disposition headers, preventing header injection attacks. This is an upstream-authored fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-5398" }, "impact_statement": "Spring Framework 5.3.39 is NOT affected by CVE-2020-5398 (Reflected File Download via unescaped quotes in Content-Disposition headers). The upstream fix from commit 41f40c6c (December 2019) was already included in the 5.3.39 release. The current code contains the appendName() method (lines 503-517 of ContentDisposition.java) that properly escapes quote characters and backslashes in filenames before embedding them in Content-Disposition headers, preventing header injection attacks. This is an upstream-authored fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-10-30T09:01:17.494754+00:00", "status_notes": "Vulnerability CVE-2022-22965 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc. Spring Framework 5.3.39 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22965" }, "impact_statement": "Spring Framework 5.3.39 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-11-04T09:15:51.446651+00:00", "status_notes": "Vulnerability CVE-2023-20860 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc. CVE-2023-20860 is not present in Spring Framework 5.3.39. The vulnerability involves pattern matching mismatch between Spring Security and Spring MVC when patterns like \"**\" lack a leading slash. The fix normalizes patterns by prepending \"/\" when missing, ensuring consistent interpretation. This fix was shipped in the upstream 5.3.39 release via commit 1cd994d3a (author: rstoyanchev@vmware.com, date: 2023-07-11), implemented in PathPatternParser.initFullPathPattern() and invoked by HandlerMappingIntrospector's match() method before pattern use.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-20860" }, "impact_statement": "CVE-2023-20860 is not present in Spring Framework 5.3.39. The vulnerability involves pattern matching mismatch between Spring Security and Spring MVC when patterns like \"**\" lack a leading slash. The fix normalizes patterns by prepending \"/\" when missing, ensuring consistent interpretation. This fix was shipped in the upstream 5.3.39 release via commit 1cd994d3a (author: rstoyanchev@vmware.com, date: 2023-07-11), implemented in PathPatternParser.initFullPathPattern() and invoked by HandlerMappingIntrospector's match() method before pattern use.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-11-03T10:02:00.051155+00:00", "status_notes": "Vulnerability CVE-2023-34053 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2023-34053 affects Spring Framework's observation feature introduced in version 6.0+. The target version 5.3.39 predates this feature entirely. The vulnerable classes (DefaultServerRequestObservationConvention) and the observation framework do not exist in this version. The CVE requires an ObservationRegistry configured with micrometer-core, which is not possible in 5.3.39.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-34053" }, "impact_statement": "not_affected \u2014 CVE-2023-34053 affects Spring Framework's observation feature introduced in version 6.0+. The target version 5.3.39 predates this feature entirely. The vulnerable classes (DefaultServerRequestObservationConvention) and the observation framework do not exist in this version. The CVE requires an ObservationRegistry configured with micrometer-core, which is not possible in 5.3.39." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38816 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2024-38816" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38819 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2024-38819" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38828 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2024-38828" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-41242 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2025-41242" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22735 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-22735" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22737 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-22737" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22741 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-22741" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22745 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-22745" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41841 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-41841" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41842 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-41842" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41843 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-41843" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41844 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-41844" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41845 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-41845" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41846 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-41846" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41853 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-41853" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-10-29T11:05:30.062758+00:00", "status_notes": "Vulnerability CVE-2026-47883 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.39 is not affected by CVE-2026-47883. The vulnerability exists in the UrlHandlerFilter class, which was introduced in Spring Framework 6.2.12 (May 2024) and does not exist in the 5.3.x release line. Version 5.3.39 was released in August 2024 without this feature. TuxCare backports of CVE-2026-47883 only target versions 6.2.x where UrlHandlerFilter exists (6.2.3, 6.2.5, 6.2....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47883" }, "impact_statement": "not_affected \u2014 Spring Framework 5.3.39 is not affected by CVE-2026-47883. The vulnerability exists in the UrlHandlerFilter class, which was introduced in Spring Framework 6.2.12 (May 2024) and does not exist in the 5.3.x release line. Version 5.3.39 was released in August 2024 without this feature. TuxCare backports of CVE-2026-47883 only target versions 6.2.x where UrlHandlerFilter exists (6.2.3, 6.2.5, 6.2...." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47884 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-47884" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47887 affects version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc, and is fixed in 5.3.39-tuxcare.22.", "vulnerability": { "name": "CVE-2026-47887" }, "action_statement": "Vulnerability CVE-2026-47887 affects version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc, and is fixed in 5.3.39-tuxcare.22." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-10-08T08:14:59.925459+00:00", "status_notes": "Vulnerability CVE-2026-47890 does not affect version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc. Spring Framework 5.3.39-tuxcare.23 is NOT AFFECTED by CVE-2026-47890. The vulnerability is specific to SSE (Server-Sent Events) with view fragments, a feature introduced in Spring Framework 6.2.0-M7 (August 2024). This feature does not exist in the 5.3.x line. Comprehensive searches confirm: no Fragment class, no FragmentRendering interface, no fragment-related SSE handling code exists in 5.3.39. The CVE's stated affected ranges (6.2.0-6.2.19, 7.0.0-7.0.8) correctly exclude 5.3.x versions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47890" }, "impact_statement": "Spring Framework 5.3.39-tuxcare.23 is NOT AFFECTED by CVE-2026-47890. The vulnerability is specific to SSE (Server-Sent Events) with view fragments, a feature introduced in Spring Framework 6.2.0-M7 (August 2024). This feature does not exist in the 5.3.x line. Comprehensive searches confirm: no Fragment class, no FragmentRendering interface, no fragment-related SSE handling code exists in 5.3.39. The CVE's stated affected ranges (6.2.0-6.2.19, 7.0.0-7.0.8) correctly exclude 5.3.x versions." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21", "identifiers": { "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.39-tuxcare.21" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59313 is fixed in version 5.3.39-tuxcare.21 of org.springframework:spring-webmvc.", "vulnerability": { "name": "CVE-2026-59313" } } ] }