{
  "@id": "urn:uuid:b836e1ff-2ff9-4582-8340-d447f2d5a8d9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 9,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:07:59.808671+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-xml@5.5.16-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-xml@5.5.16-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2019-3772 does not affect version 5.5.16-tuxcare.2 of org.springframework.integration:spring-integration-xml. Spring Integration 5.5.16 is not affected by CVE-2019-3772 (XXE vulnerability). The target version uses DocumentBuilderFactoryUtils.newInstance() from the spring-xml module (version 3.1.4), which provides built-in XXE protection by default. CVE-2019-3772 affected versions \u22645.1.1; the fix was included in Spring Integration 5.1.2+ (released January 2019) by leveraging secure XML parsers from spring-xml. The target version 5.5.16 (released much later) inherits this protection. No TuxCare backport exists for this CVE, confirming the fix was already in the upstream release. All XML parsing paths in spring-integration-xml and spring-integration-ws modules delegate to DocumentBuilderFactoryUtils, and no code overrides the security defaults.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2; < 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2), NVD (<= 4.3.18; >= 5.0.0, <= 5.0.10; >= 5.1.0, <= 5.1.1), cve.org (>= 5.0, < 5.0.10.RELEASE; >= 5.1, < 5.1.1.RELEASE; >= 4.3, < 4.3.18.RELEASE), Snyk (>= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE; >= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE).",
      "vulnerability": {
        "name": "CVE-2019-3772"
      },
      "impact_statement": "Spring Integration 5.5.16 is not affected by CVE-2019-3772 (XXE vulnerability). The target version uses DocumentBuilderFactoryUtils.newInstance() from the spring-xml module (version 3.1.4), which provides built-in XXE protection by default. CVE-2019-3772 affected versions \u22645.1.1; the fix was included in Spring Integration 5.1.2+ (released January 2019) by leveraging secure XML parsers from spring-xml. The target version 5.5.16 (released much later) inherits this protection. No TuxCare backport exists for this CVE, confirming the fix was already in the upstream release. All XML parsing paths in spring-integration-xml and spring-integration-ws modules delegate to DocumentBuilderFactoryUtils, and no code overrides the security defaults.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2; < 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2), NVD (<= 4.3.18; >= 5.0.0, <= 5.0.10; >= 5.1.0, <= 5.1.1), cve.org (>= 5.0, < 5.0.10.RELEASE; >= 5.1, < 5.1.1.RELEASE; >= 4.3, < 4.3.18.RELEASE), Snyk (>= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE; >= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE)."
    }
  ]
}