{
  "@id": "urn:uuid:a0db05b7-a2f0-4884-b27f-de10ff591720",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 35,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40988 affects version 6.2.2-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider, and is fixed in 6.2.2-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-40988"
      },
      "action_statement": "Vulnerability CVE-2026-40988 affects version 6.2.2-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider, and is fixed in 6.2.2-tuxcare.4."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40993 does not affect version 6.2.2-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider. Spring Security 6.2.2 is not affected by CVE-2026-40993. The vulnerable class JdbcAssertingPartyMetadataRepository and the entire JDBC-based SAML2 asserting party metadata persistence feature do not exist in this version. This feature was introduced in Spring Security 7.0.0, which is newer than the target version. The CVE affects only versions 7.0.0 through 7.0.5.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40993"
      },
      "impact_statement": "Spring Security 6.2.2 is not affected by CVE-2026-40993. The vulnerable class JdbcAssertingPartyMetadataRepository and the entire JDBC-based SAML2 asserting party metadata persistence feature do not exist in this version. This feature was introduced in Spring Security 7.0.0, which is newer than the target version. The CVE affects only versions 7.0.0 through 7.0.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-05T08:29:00.102167+00:00",
      "status_notes": "Vulnerability CVE-2026-41003 affects version 6.2.2-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider, and is fixed in 6.2.2-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-41003"
      },
      "action_statement": "Vulnerability CVE-2026-41003 affects version 6.2.2-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider, and is fixed in 6.2.2-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.2-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-saml2-service-provider@6.2.2-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41694 affects version 6.2.2-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider, and is fixed in 6.2.2-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41694"
      },
      "action_statement": "Vulnerability CVE-2026-41694 affects version 6.2.2-tuxcare.3 of org.springframework.security:spring-security-saml2-service-provider, and is fixed in 6.2.2-tuxcare.4."
    }
  ]
}