{
  "@id": "urn:uuid:59d1c704-38d3-44af-a83b-f881dcd7437b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:05:53.304095+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-xml@6.2.11-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-xml@6.2.11-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:05:53.304095+00:00",
      "status_notes": "Vulnerability CVE-2019-3772 does not affect version 6.2.11-tuxcare.1 of org.springframework.integration:spring-integration-xml. Spring Integration 6.2.11 is not affected by CVE-2019-3772 (XXE vulnerability). The target uses Spring Framework 6.1.15's DocumentBuilderFactoryUtils which provides XXE protection by default by disabling external entity processing in all XML parsers. This protection was introduced in Spring Framework 5.1.3 (December 2018) and is present in all modern versions. All XML parsing in spring-integration-xml and spring-integration-ws modules delegates to DocumentBuilderFactoryUtils.newInstance(), and no code bypasses this protection. The vulnerable pattern (unprotected XML parsing) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2; < 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2), NVD (<= 4.3.18; >= 5.0.0, <= 5.0.10; >= 5.1.0, <= 5.1.1), cve.org (>= 5.0, < 5.0.10.RELEASE; >= 5.1, < 5.1.1.RELEASE; >= 4.3, < 4.3.18.RELEASE), Snyk (>= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE; >= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3772"
      },
      "impact_statement": "Spring Integration 6.2.11 is not affected by CVE-2019-3772 (XXE vulnerability). The target uses Spring Framework 6.1.15's DocumentBuilderFactoryUtils which provides XXE protection by default by disabling external entity processing in all XML parsers. This protection was introduced in Spring Framework 5.1.3 (December 2018) and is present in all modern versions. All XML parsing in spring-integration-xml and spring-integration-ws modules delegates to DocumentBuilderFactoryUtils.newInstance(), and no code bypasses this protection. The vulnerable pattern (unprotected XML parsing) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2; < 4.3.19; >= 5.0.0, < 5.0.11; >= 5.1.0, < 5.1.2), NVD (<= 4.3.18; >= 5.0.0, <= 5.0.10; >= 5.1.0, <= 5.1.1), cve.org (>= 5.0, < 5.0.10.RELEASE; >= 5.1, < 5.1.1.RELEASE; >= 4.3, < 4.3.18.RELEASE), Snyk (>= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE; >= 5.1.0.RELEASE, < 5.1.2.RELEASE; >= 5.0.0.RELEASE, < 5.0.11.RELEASE; < 4.3.19.RELEASE)."
    }
  ]
}