{
  "@id": "urn:uuid:177f2bf4-6f4c-4184-8d10-7aea39a19d4f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:02:01.158878+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@3.0.10.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@3.0.10.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:02:01.158878+00:00",
      "status_notes": "Vulnerability CVE-2019-3774 does not affect version 3.0.10.RELEASE-tuxcare.2 of org.springframework.batch:spring-batch-core. CVE-2019-3774 (XXE in Spring Batch XML parsing) does NOT affect this target. The XXE defense was already present in the upstream Spring Batch 3.0.10.RELEASE that TuxCare onboarded. The fix commit (c7930184e by Mahmoud Ben Hassine <mbenhassine@pivotal.io>, Jan 11 2019) hardened XMLInputFactory by disabling DTD processing and external entity resolution. This commit predates TuxCare's onboarding commit (cb96c08fe), confirming the fix shipped in the upstream release. The vulnerable pattern (unsafe XML parsing allowing external entity expansion to read local files) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3774"
      },
      "impact_statement": "CVE-2019-3774 (XXE in Spring Batch XML parsing) does NOT affect this target. The XXE defense was already present in the upstream Spring Batch 3.0.10.RELEASE that TuxCare onboarded. The fix commit (c7930184e by Mahmoud Ben Hassine <mbenhassine@pivotal.io>, Jan 11 2019) hardened XMLInputFactory by disabling DTD processing and external entity resolution. This commit predates TuxCare's onboarding commit (cb96c08fe), confirming the fix shipped in the upstream release. The vulnerable pattern (unsafe XML parsing allowing external entity expansion to read local files) is not present in the target code.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.10.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 4.1.0.RELEASE, < 4.1.1.RELEASE), NVD (<= 3.0.9; >= 4.0.0, <= 4.0.1; = 4.1.0), cve.org (>= 4.0, < 4.0.1.RELEASE; >= 4.1, < 4.1.0.RELEASE; >= 3.0, < 3.0.9.RELEASE), Snyk (>= 4.1.0.RELEASE, < 4.1.1.RELEASE; >= 4.0.0.RELEASE, < 4.0.2.RELEASE; >= 3.0.9.RELEASE, < 3.0.10.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@3.0.10.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@3.0.10.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:54:01.956685+00:00",
      "status_notes": "Vulnerability CVE-2020-5411 affects version 3.0.10.RELEASE-tuxcare.2 of org.springframework.batch:spring-batch-core.",
      "vulnerability": {
        "name": "CVE-2020-5411"
      },
      "action_statement": "Vulnerability CVE-2020-5411 affects version 3.0.10.RELEASE-tuxcare.2 of org.springframework.batch:spring-batch-core."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@3.0.10.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@3.0.10.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T15:30:49.741847+00:00",
      "status_notes": "Vulnerability CVE-2026-47875 does not affect version 3.0.10.RELEASE-tuxcare.2 of org.springframework.batch:spring-batch-core. not_affected \u2014 Spring Batch 3.0.10.RELEASE is not affected by CVE-2026-47875. The vulnerable code (JobParameterDeserializer class with unchecked Class.forName()) was introduced in Spring Batch 5.0.0 (September 2022), years after 3.0.10.RELEASE. This version only supports four fixed parameter types (String, Long, Date, Double) and lacks the arbitrary type deserialization mechanism that enables the vulnerabilit...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-47875"
      },
      "impact_statement": "not_affected \u2014 Spring Batch 3.0.10.RELEASE is not affected by CVE-2026-47875. The vulnerable code (JobParameterDeserializer class with unchecked Class.forName()) was introduced in Spring Batch 5.0.0 (September 2022), years after 3.0.10.RELEASE. This version only supports four fixed parameter types (String, Long, Date, Double) and lacks the arbitrary type deserialization mechanism that enables the vulnerabilit..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.batch/spring-batch-core@3.0.10.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.batch/spring-batch-core@3.0.10.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-14T14:54:01.956685+00:00",
      "status_notes": "Vulnerability CVE-2026-47878 is fixed in version 3.0.10.RELEASE-tuxcare.2 of org.springframework.batch:spring-batch-core.",
      "vulnerability": {
        "name": "CVE-2026-47878"
      }
    }
  ]
}