{
  "@id": "urn:uuid:419cb10c-b06c-4044-a522-062eb5dc1f76",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-11T16:45:37.789161+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.2.5-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.2.5-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T16:45:37.789161+00:00",
      "status_notes": "Vulnerability CVE-2020-5413 does not affect version 6.2.5-tuxcare.5 of org.springframework.integration:spring-integration-core. CVE-2020-5413 does not affect Spring Integration 6.2.5-tuxcare.4. The vulnerability (Kryo codec allowing unregistered class resolution during deserialization, enabling deserialization gadget attacks) was fixed in upstream commit 6a02b5abe9 on 2020-07-22. This fix was already present in the upstream Spring Integration 6.2.5 release that TuxCare onboarded in September 2026. The fix adds kryo.setRegistrationRequired(true) to AbstractKryoCodec, preventing automatic instantiation of unregistered classes during deserialization. All codec implementations (PojoCodec, MessageCodec) inherit this protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.3.0, < 4.3.23; >= 5.3.0, < 5.3.2; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8), NVD (>= 4.3.0, <= 4.3.22; >= 5.1.0, <= 5.1.11; >= 5.2.0, <= 5.2.7; >= 5.3.0, <= 5.3.1), cve.org (>= 4.3, < 4.3.23.RELEASE; >= 5.1, < 5.1.12.RELEASE; >= 5.2, < 5.2.8.RELEASE; >= 5.3, < 5.3.2.RELEASE), Snyk (>= 4.3.0, < 4.3.23; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5413"
      },
      "impact_statement": "CVE-2020-5413 does not affect Spring Integration 6.2.5-tuxcare.4. The vulnerability (Kryo codec allowing unregistered class resolution during deserialization, enabling deserialization gadget attacks) was fixed in upstream commit 6a02b5abe9 on 2020-07-22. This fix was already present in the upstream Spring Integration 6.2.5 release that TuxCare onboarded in September 2026. The fix adds kryo.setRegistrationRequired(true) to AbstractKryoCodec, preventing automatic instantiation of unregistered classes during deserialization. All codec implementations (PojoCodec, MessageCodec) inherit this protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.3.0, < 4.3.23; >= 5.3.0, < 5.3.2; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8), NVD (>= 4.3.0, <= 4.3.22; >= 5.1.0, <= 5.1.11; >= 5.2.0, <= 5.2.7; >= 5.3.0, <= 5.3.1), cve.org (>= 4.3, < 4.3.23.RELEASE; >= 5.1, < 5.1.12.RELEASE; >= 5.2, < 5.2.8.RELEASE; >= 5.3, < 5.3.2.RELEASE), Snyk (>= 4.3.0, < 4.3.23; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.2)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.2.5-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.2.5-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T16:45:37.789161+00:00",
      "status_notes": "Vulnerability CVE-2026-47856 is fixed in version 6.2.5-tuxcare.5 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-47856"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.2.5-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.2.5-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T16:45:37.789161+00:00",
      "status_notes": "Vulnerability CVE-2026-59292 is fixed in version 6.2.5-tuxcare.5 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59292"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.2.5-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.2.5-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T16:45:37.789161+00:00",
      "status_notes": "Vulnerability CVE-2026-59322 is fixed in version 6.2.5-tuxcare.5 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59322"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.2.5-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.2.5-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-11T16:45:37.789161+00:00",
      "status_notes": "Vulnerability CVE-2026-59324 is fixed in version 6.2.5-tuxcare.5 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59324"
      }
    }
  ]
}