{
  "@id": "urn:uuid:6ad39d83-9042-4829-84d5-55a8d4da5219",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.4.10-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.4.10-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2020-5413 does not affect version 6.4.10-tuxcare.4 of org.springframework.integration:spring-integration-core. CVE-2020-5413 is NOT present in Spring Integration 6.4.10. The vulnerability concerns Kryo codec allowing deserialization of arbitrary unregistered classes, enabling deserialization gadget attacks. The upstream fix (adding `kryo.setRegistrationRequired(true);` in AbstractKryoCodec.java) was already included in the Spring Integration 6.4.10 release that TuxCare onboarded. The vulnerable code pattern does not exist in the target because the security defense was shipped by upstream before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.3.0, < 4.3.23; >= 5.3.0, < 5.3.2; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8), NVD (>= 4.3.0, <= 4.3.22; >= 5.1.0, <= 5.1.11; >= 5.2.0, <= 5.2.7; >= 5.3.0, <= 5.3.1), cve.org (>= 4.3, < 4.3.23.RELEASE; >= 5.1, < 5.1.12.RELEASE; >= 5.2, < 5.2.8.RELEASE; >= 5.3, < 5.3.2.RELEASE), Snyk (>= 4.3.0, < 4.3.23; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.2).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5413"
      },
      "impact_statement": "CVE-2020-5413 is NOT present in Spring Integration 6.4.10. The vulnerability concerns Kryo codec allowing deserialization of arbitrary unregistered classes, enabling deserialization gadget attacks. The upstream fix (adding `kryo.setRegistrationRequired(true);` in AbstractKryoCodec.java) was already included in the Spring Integration 6.4.10 release that TuxCare onboarded. The vulnerable code pattern does not exist in the target because the security defense was shipped by upstream before TuxCare's involvement.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.3.0, < 4.3.23; >= 5.3.0, < 5.3.2; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8), NVD (>= 4.3.0, <= 4.3.22; >= 5.1.0, <= 5.1.11; >= 5.2.0, <= 5.2.7; >= 5.3.0, <= 5.3.1), cve.org (>= 4.3, < 4.3.23.RELEASE; >= 5.1, < 5.1.12.RELEASE; >= 5.2, < 5.2.8.RELEASE; >= 5.3, < 5.3.2.RELEASE), Snyk (>= 4.3.0, < 4.3.23; >= 5.1.0, < 5.1.12; >= 5.2.0, < 5.2.8; >= 5.3.0, < 5.3.2)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.4.10-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.4.10-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-07T15:39:00.190352+00:00",
      "status_notes": "Vulnerability CVE-2026-47856 is fixed in version 6.4.10-tuxcare.4 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-47856"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.4.10-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.4.10-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-07T15:39:00.190352+00:00",
      "status_notes": "Vulnerability CVE-2026-59292 is fixed in version 6.4.10-tuxcare.4 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59292"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.4.10-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.4.10-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-07T15:39:00.190352+00:00",
      "status_notes": "Vulnerability CVE-2026-59322 is fixed in version 6.4.10-tuxcare.4 of org.springframework.integration:spring-integration-core.",
      "vulnerability": {
        "name": "CVE-2026-59322"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-core@6.4.10-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-core@6.4.10-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-13T15:58:00.097131+00:00",
      "status_notes": "Vulnerability CVE-2026-59324 affects version 6.4.10-tuxcare.4 of org.springframework.integration:spring-integration-core, and is fixed in 6.4.10-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-59324"
      },
      "action_statement": "Vulnerability CVE-2026-59324 affects version 6.4.10-tuxcare.4 of org.springframework.integration:spring-integration-core, and is fixed in 6.4.10-tuxcare.5."
    }
  ]
}