{
  "@id": "urn:uuid:6950dd1a-03af-459e-8e73-78f3d3c2e493",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:04:11.456857+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.16-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.16-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:04:11.456857+00:00",
      "status_notes": "Vulnerability CVE-2020-5413 does not affect version 5.5.16-tuxcare.2 of org.springframework.integration:spring-integration-core. The target Spring Integration 5.5.16 is NOT AFFECTED by CVE-2020-5413. The upstream fix (commit 6a02b5abe9, adding `kryo.setRegistrationRequired(true)`) shipped in the Spring Integration 5.5.16 release before TuxCare onboarded it. The vulnerable pattern\u2014Kryo accepting arbitrary unregistered classes for deserialization\u2014is not present in the target code. All Kryo codec instances inherit from AbstractKryoCodec which enforces registration-required mode at line 47, blocking deserialization gadget attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.3.0, < 4.3.23; >= 5.3.0, < 5.3.2; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8), NVD (>= 4.3.0, <= 4.3.22; >= 5.1.0, <= 5.1.11; >= 5.2.0, <= 5.2.7; >= 5.3.0, <= 5.3.1), cve.org (>= 4.3, < 4.3.23.RELEASE; >= 5.1, < 5.1.12.RELEASE; >= 5.2, < 5.2.8.RELEASE; >= 5.3, < 5.3.2.RELEASE), Snyk (>= 4.3.0, < 4.3.23; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5413"
      },
      "impact_statement": "The target Spring Integration 5.5.16 is NOT AFFECTED by CVE-2020-5413. The upstream fix (commit 6a02b5abe9, adding `kryo.setRegistrationRequired(true)`) shipped in the Spring Integration 5.5.16 release before TuxCare onboarded it. The vulnerable pattern\u2014Kryo accepting arbitrary unregistered classes for deserialization\u2014is not present in the target code. All Kryo codec instances inherit from AbstractKryoCodec which enforces registration-required mode at line 47, blocking deserialization gadget attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.3.0, < 4.3.23; >= 5.3.0, < 5.3.2; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8), NVD (>= 4.3.0, <= 4.3.22; >= 5.1.0, <= 5.1.11; >= 5.2.0, <= 5.2.7; >= 5.3.0, <= 5.3.1), cve.org (>= 4.3, < 4.3.23.RELEASE; >= 5.1, < 5.1.12.RELEASE; >= 5.2, < 5.2.8.RELEASE; >= 5.3, < 5.3.2.RELEASE), Snyk (>= 4.3.0, < 4.3.23; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.2)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.16-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.16-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T17:37:00.116800+00:00",
      "status_notes": "Vulnerability CVE-2026-47856 is fixed in version 5.5.16-tuxcare.2 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-47856"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.16-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.16-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T17:37:00.116800+00:00",
      "status_notes": "Vulnerability CVE-2026-59292 is fixed in version 5.5.16-tuxcare.2 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59292"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.16-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.16-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T17:40:14.726759+00:00",
      "status_notes": "Vulnerability CVE-2026-59322 is fixed in version 5.5.16-tuxcare.2 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59322"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.16-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@5.5.16-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T17:40:14.726759+00:00",
      "status_notes": "Vulnerability CVE-2026-59324 is fixed in version 5.5.16-tuxcare.2 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59324"
      }
    }
  ]
}