{
  "@id": "urn:uuid:c172d369-f6ab-40d8-a4f3-c8aae21d72d8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 24,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:42:49.066061+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-bom@6.1.6-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-bom@6.1.6-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:42:49.066061+00:00",
      "status_notes": "Vulnerability CVE-2021-22112 does not affect version 6.1.6-tuxcare.4 of org.springframework.security:spring-security-bom. The target repository (Spring Security 6.1.6-tuxcare.9) is NOT AFFECTED by CVE-2021-22112. The vulnerability was fixed in the upstream Spring Security release before TuxCare onboarded version 6.1.6. The fix (commit 3116369f02 by Rob Winch) adds tracking of saveContext invocations via the isSaveContextInvoked flag, ensuring that SecurityContext changes are properly saved even when changed multiple times in a single request. This upstream fix is present in the target at HEAD (ddc661b43f).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22112"
      },
      "impact_statement": "The target repository (Spring Security 6.1.6-tuxcare.9) is NOT AFFECTED by CVE-2021-22112. The vulnerability was fixed in the upstream Spring Security release before TuxCare onboarded version 6.1.6. The fix (commit 3116369f02 by Rob Winch) adds tracking of saveContext invocations via the isSaveContextInvoked flag, ensuring that SecurityContext changes are properly saved even when changed multiple times in a single request. This upstream fix is present in the target at HEAD (ddc661b43f).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE)."
    }
  ]
}