{
  "@id": "urn:uuid:717432fe-b94a-44c5-8827-b9ca71919e5e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T16:15:35.424937+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-bom@5.6.5-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-bom@5.6.5-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T16:15:35.424937+00:00",
      "status_notes": "Vulnerability CVE-2021-22112 does not affect version 5.6.5-tuxcare.3 of org.springframework.security:spring-security-bom. CVE-2021-22112 affects Spring Security versions prior to 5.4.4, 5.3.8, and 5.2.9, where the SecurityContext fails to persist when changed multiple times in a single request. The target version 5.6.5 already contains the upstream fix (commit 3116369f02) that was shipped in the upstream release. The fix introduces the isSaveContextInvoked flag and modifies the contextChanged() method to properly track and persist multiple SecurityContext changes. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22112"
      },
      "impact_statement": "CVE-2021-22112 affects Spring Security versions prior to 5.4.4, 5.3.8, and 5.2.9, where the SecurityContext fails to persist when changed multiple times in a single request. The target version 5.6.5 already contains the upstream fix (commit 3116369f02) that was shipped in the upstream release. The fix introduces the isSaveContextInvoked flag and modifies the contextChanged() method to properly track and persist multiple SecurityContext changes. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE)."
    }
  ]
}