{
  "@id": "urn:uuid:0be1389f-16f5-481c-87df-07342a831971",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T18:19:31.434465+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T07:54:24.701016+00:00",
      "status_notes": "Vulnerability CVE-2021-22112 affects version 5.5.7-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2021-22112"
      },
      "action_statement": "Vulnerability CVE-2021-22112 affects version 5.5.7-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T07:54:24.701016+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 affects version 5.5.7-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "action_statement": "Vulnerability CVE-2022-22978 affects version 5.5.7-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T18:19:31.434465+00:00",
      "status_notes": "Vulnerability CVE-2024-38821 affects version 5.5.7-tuxcare.1 of org.springframework.security:spring-security-web, and is fixed in 5.5.7-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2024-38821"
      },
      "action_statement": "Vulnerability CVE-2024-38821 affects version 5.5.7-tuxcare.1 of org.springframework.security:spring-security-web, and is fixed in 5.5.7-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T18:19:31.434465+00:00",
      "status_notes": "Vulnerability CVE-2026-22732 affects version 5.5.7-tuxcare.1 of org.springframework.security:spring-security-web, and is fixed in 5.5.7-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-22732"
      },
      "action_statement": "Vulnerability CVE-2026-22732 affects version 5.5.7-tuxcare.1 of org.springframework.security:spring-security-web, and is fixed in 5.5.7-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:40:00.636701+00:00",
      "status_notes": "Vulnerability CVE-2026-22747 does not affect version 5.5.7-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 CVE-2026-22747 affects SubjectX500PrincipalExtractor, a class that does not exist in spring-security 5.5.7. The only CN-based extractor here is the deprecated SubjectDnX509PrincipalExtractor. The CVE text says the fix does not cover that class. Same product lineage, so not a false positive. Residual note: the regex-on-DN design of the legacy extractor is lenient, but it is outside this CVE's sc...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22747"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-22747 affects SubjectX500PrincipalExtractor, a class that does not exist in spring-security 5.5.7. The only CN-based extractor here is the deprecated SubjectDnX509PrincipalExtractor. The CVE text says the fix does not cover that class. Same product lineage, so not a false positive. Residual note: the regex-on-DN design of the legacy extractor is lenient, but it is outside this CVE's sc..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T18:37:08.254253+00:00",
      "status_notes": "Vulnerability CVE-2026-22754 does not affect version 5.5.7-tuxcare.1 of org.springframework.security:spring-security-web. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.5.7 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4vrc-j85c-598c (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22754"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.5.7 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4vrc-j85c-598c (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-09T18:19:16.571947+00:00",
      "status_notes": "Vulnerability CVE-2026-41706 affects version 5.5.7-tuxcare.1 of org.springframework.security:spring-security-web, and is fixed in 5.5.7-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-41706"
      },
      "action_statement": "Vulnerability CVE-2026-41706 affects version 5.5.7-tuxcare.1 of org.springframework.security:spring-security-web, and is fixed in 5.5.7-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T07:54:24.701016+00:00",
      "status_notes": "Vulnerability CVE-2026-47838 affects version 5.5.7-tuxcare.1 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-47838"
      },
      "action_statement": "Vulnerability CVE-2026-47838 affects version 5.5.7-tuxcare.1 of org.springframework.security:spring-security-web."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.5.7-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.5.7-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T18:41:00.076869+00:00",
      "status_notes": "Vulnerability CVE-2026-47841 does not affect version 5.5.7-tuxcare.1 of org.springframework.security:spring-security-web. Prechecker: No vulnerable code from the fix was found; the vulnerable lines are absent, this version declares none of the classes the fix changes, and their base package is absent. Version 5.5.7 is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-47841"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; the vulnerable lines are absent, this version declares none of the classes the fix changes, and their base package is absent. Version 5.5.7 is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only)."
    }
  ]
}