{
  "@id": "urn:uuid:a5a7e708-aca3-448d-a939-f8c74df9c4a1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 35,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:14:29.621948+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:14:29.621948+00:00",
      "status_notes": "Vulnerability CVE-2021-22119 does not affect version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client. CVE-2021-22119 is NOT present in Spring Security 6.2.7. The vulnerable pattern (unbounded Map accumulation in OAuth2 authorization request storage) was fixed in upstream commit 35f5ebdbcf (April 2021) by Craig Andrews. The fix was already included in the upstream 6.2.7 release (October 2024) before TuxCare onboarded it. The target code stores only ONE authorization request per session, replacing old requests instead of accumulating them in a Map, preventing the DoS attack via memory exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22119"
      },
      "impact_statement": "CVE-2021-22119 is NOT present in Spring Security 6.2.7. The vulnerable pattern (unbounded Map accumulation in OAuth2 authorization request storage) was fixed in upstream commit 35f5ebdbcf (April 2021) by Craig Andrews. The fix was already included in the upstream 6.2.7 release (October 2024) before TuxCare onboarded it. The target code stores only ONE authorization request per session, replacing old requests instead of accumulating them in a Map, preventing the DoS attack via memory exhaustion.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11; >= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0, < 5.3.10; >= 5.2.0, < 5.2.11), NVD (>= 5.2.0, < 5.2.11; >= 5.3.0, < 5.3.10; >= 5.4.0, < 5.4.7; >= 5.5.0, < 5.5.1), cve.org (>= 5.5, < 5.5.1; >= 5.4, < 5.4.7; >= 5.3, < 5.3.10; < 5.2.x; < 5.2.11), Snyk (>= 5.5.0, < 5.5.1; >= 5.4.0, < 5.4.7; >= 5.3.0.RELEASE, < 5.3.10.RELEASE; >= 5.2.0.RELEASE, < 5.2.11.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.7-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-client@6.2.7-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-04T09:07:59.808671+00:00",
      "status_notes": "Vulnerability CVE-2022-31690 does not affect version 6.2.7-tuxcare.2 of org.springframework.security:spring-security-oauth2-client. CVE-2022-31690 (OAuth2 privilege escalation via empty scope substitution) is NOT present in spring-security 6.2.7-tuxcare.8. All three upstream fix commits (75004587a4, fde26e003a, 5560bbaa8) were already included in the upstream Spring Security 6.2.7 release that TuxCare onboarded. The vulnerable pattern \u2014 automatic substitution of client-requested scopes when Authorization Server returns empty scopes \u2014 has been removed from all affected token response clients (both synchronous Default* and reactive WebClientReactive* implementations). The target correctly preserves empty scopes from the Authorization Server response instead of escalating privileges by substituting originally-requested scopes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-31690"
      },
      "impact_statement": "CVE-2022-31690 (OAuth2 privilege escalation via empty scope substitution) is NOT present in spring-security 6.2.7-tuxcare.8. All three upstream fix commits (75004587a4, fde26e003a, 5560bbaa8) were already included in the upstream Spring Security 6.2.7 release that TuxCare onboarded. The vulnerable pattern \u2014 automatic substitution of client-requested scopes when Authorization Server returns empty scopes \u2014 has been removed from all affected token response clients (both synchronous Default* and reactive WebClientReactive* implementations). The target correctly preserves empty scopes from the Authorization Server response instead of escalating privileges by substituting originally-requested scopes.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.7.0, < 5.7.5; < 5.6.9), NVD (>= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5), cve.org (>= 5.7, <= 5.7.4; >= 5.6, <= 5.6.8), Snyk (< 5.4.11; >= 5.6.0, < 5.6.9; >= 5.7.0, < 5.7.5)."
    }
  ]
}