{
  "@id": "urn:uuid:5cca95d7-1619-45c1-9111-b7566253b1e0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T02:23:48.198619+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-bom@6.0.8-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-bom@6.0.8-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-09T02:23:48.198619+00:00",
      "status_notes": "Vulnerability CVE-2021-22112 does not affect version 6.0.8-tuxcare.7 of org.springframework.security:spring-security-bom. Spring Security 6.0.8 is not affected by CVE-2021-22112. The vulnerability (failure to save SecurityContext when changed multiple times in a single request) was fixed in upstream Spring Security 5.4.4 via commit c72a6fac04. This fix was already present in version 6.0.8 when TuxCare onboarded it. The target code contains the complete mitigation: a boolean flag `isSaveContextInvoked` that tracks whether saveContext() has been called, ensuring subsequent context saves are always persisted even if the context reference matches the original.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22112"
      },
      "impact_statement": "Spring Security 6.0.8 is not affected by CVE-2021-22112. The vulnerability (failure to save SecurityContext when changed multiple times in a single request) was fixed in upstream Spring Security 5.4.4 via commit c72a6fac04. This fix was already present in version 6.0.8 when TuxCare onboarded it. The target code contains the complete mitigation: a boolean flag `isSaveContextInvoked` that tracks whether saveContext() has been called, ensuring subsequent context saves are always persisted even if the context reference matches the original.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE)."
    }
  ]
}