{
  "@id": "urn:uuid:abedee8d-e314-4a9b-90df-6839d74427e3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-09T18:30:53.102119+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2021-22112 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-web. CVE-2021-22112 is NOT present in Spring Security 5.6.3. The vulnerability (SecurityContext not saved when changed multiple times in a single request) was fixed by upstream commit 3116369f in January 2021. This fix was already included in the upstream Spring Security 5.6.3 release that TuxCare onboarded. The target version is newer than all affected versions listed in the CVE (5.4.x < 5.4.4, 5.3.x < 5.3.8, 5.2.x < 5.2.9). The fix adds an isSaveContextInvoked flag to track multiple saveContext() calls and ensures the final SecurityContext is persisted, preventing privilege escalation scenarios where temporary elevated privileges would incorrectly persist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22112"
      },
      "impact_statement": "CVE-2021-22112 is NOT present in Spring Security 5.6.3. The vulnerability (SecurityContext not saved when changed multiple times in a single request) was fixed by upstream commit 3116369f in January 2021. This fix was already included in the upstream Spring Security 5.6.3 release that TuxCare onboarded. The target version is newer than all affected versions listed in the CVE (5.4.x < 5.4.4, 5.3.x < 5.3.8, 5.2.x < 5.2.9). The fix adds an isSaveContextInvoked flag to track multiple saveContext() calls and ensures the final SecurityContext is persisted, preventing privilege escalation scenarios where temporary elevated privileges would incorrectly persist.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 affects version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "action_statement": "Vulnerability CVE-2022-22978 affects version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-web."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:53.102119+00:00",
      "status_notes": "Vulnerability CVE-2024-38821 is fixed in version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2024-38821"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2026-22732 affects version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-22732"
      },
      "action_statement": "Vulnerability CVE-2026-22732 affects version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-web."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2026-22747 affects version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-22747"
      },
      "action_statement": "Vulnerability CVE-2026-22747 affects version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-web."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2026-22754 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-web. Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.6.3 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4vrc-j85c-598c (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22754"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and this version calls none of the distinctive methods on the lines the fix removes. Version 5.6.3 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-4vrc-j85c-598c (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (newer lines only)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:53.102119+00:00",
      "status_notes": "Vulnerability CVE-2026-41706 is fixed in version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-41706"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:53.102119+00:00",
      "status_notes": "Vulnerability CVE-2026-47838 is fixed in version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-47838"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@5.6.3-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@5.6.3-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-11-09T18:30:36.984659+00:00",
      "status_notes": "Vulnerability CVE-2026-47841 does not affect version 5.6.3-tuxcare.3 of org.springframework.security:spring-security-web. Prechecker: No vulnerable code from the fix was found; the vulnerable lines are absent, this version declares none of the classes the fix changes, and their base package is absent. Version 5.6.3 is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-47841"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found; the vulnerable lines are absent, this version declares none of the classes the fix changes, and their base package is absent. Version 5.6.3 is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only)."
    }
  ]
}