{
  "@id": "urn:uuid:b527e8d0-e46c-4b11-a4e6-326c25a540bc",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 22,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:47:30.687322+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-bom@5.7.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-bom@5.7.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:47:30.687322+00:00",
      "status_notes": "Vulnerability CVE-2021-22112 does not affect version 5.7.7-tuxcare.1 of org.springframework.security:spring-security-bom. CVE-2021-22112 is not present in Spring Security 5.7.7. The vulnerability affected versions 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8, and 5.2.x prior to 5.2.9, where the SecurityContext would fail to save if changed more than once in a single request. The fix (commit 3116369f027 by Rob Winch, 2021-01-22) was already included in the upstream Spring Security 5.7.7 release. The vulnerable pattern\u2014a guard check preventing multiple saveContext calls\u2014is absent from the target. The current code correctly tracks all save invocations via the isSaveContextInvoked flag and ensures subsequent SecurityContext changes are persisted.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22112"
      },
      "impact_statement": "CVE-2021-22112 is not present in Spring Security 5.7.7. The vulnerability affected versions 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8, and 5.2.x prior to 5.2.9, where the SecurityContext would fail to save if changed more than once in a single request. The fix (commit 3116369f027 by Rob Winch, 2021-01-22) was already included in the upstream Spring Security 5.7.7 release. The vulnerable pattern\u2014a guard check preventing multiple saveContext calls\u2014is absent from the target. The current code correctly tracks all save invocations via the isSaveContextInvoked flag and ensures subsequent SecurityContext changes are persisted.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE)."
    }
  ]
}