{ "@id": "urn:uuid:cd04efb7-be98-4cf9-a5cc-ef7e8bb0ac0c", "role": "Document Creator", "author": "https://tuxcare.com", "version": 37, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T18:18:00.046080+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.14-tuxcare.6" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2007-1651 is a false positive for org.springframework.security:spring-security-web 5.7.14-tuxcare.6. direct vulnerability is in OpenID project", "vulnerability": { "name": "CVE-2007-1651" }, "impact_statement": "direct vulnerability is in OpenID project" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.14-tuxcare.6" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2007-1652 is a false positive for org.springframework.security:spring-security-web 5.7.14-tuxcare.6. direct vulnerability is in OpenID project", "vulnerability": { "name": "CVE-2007-1652" }, "impact_statement": "direct vulnerability is in OpenID project" }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.14-tuxcare.6" } } ], "timestamp": "2026-11-03T12:42:49.066061+00:00", "status_notes": "Vulnerability CVE-2021-22112 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-web. Spring Security 5.7.14 is not affected by CVE-2021-22112. The upstream vendor (Spring Security project) fixed this vulnerability in commit c72a6fac04 dated 2021-01-22, which is present in the upstream 5.7.14 release that TuxCare onboarded in 2026-03-23. The target code contains the complete fix: the isSaveContextInvoked flag properly tracks multiple saveContext() invocations within a single request, ensuring the final SecurityContext value is correctly persisted to the HTTP session. The CVE affects only much older versions (5.4.x < 5.4.4, 5.3.x < 5.3.8, 5.2.x < 5.2.9).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-22112" }, "impact_statement": "Spring Security 5.7.14 is not affected by CVE-2021-22112. The upstream vendor (Spring Security project) fixed this vulnerability in commit c72a6fac04 dated 2021-01-22, which is present in the upstream 5.7.14 release that TuxCare onboarded in 2026-03-23. The target code contains the complete fix: the isSaveContextInvoked flag properly tracks multiple saveContext() invocations within a single request, ensuring the final SecurityContext value is correctly persisted to the HTTP session. The CVE affects only much older versions (5.4.x < 5.4.4, 5.3.x < 5.3.8, 5.2.x < 5.2.9).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.14-tuxcare.6" } } ], "timestamp": "2026-11-03T12:18:14.184922+00:00", "status_notes": "Vulnerability CVE-2022-22978 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-web. CVE-2022-22978: Spring Security 5.7.14 is NOT AFFECTED. The vulnerability (RegexRequestMatcher authorization bypass via newline characters in paths) was fixed in upstream commit c6461d61babfcf92febfd0a85785623e53190a8f (May 12, 2022) and was already included in the Spring Security 5.7.14 release (November 18, 2024) before TuxCare onboarded it (March 23, 2026). The target code has Pattern.DOTALL set as the default regex flag, which makes the '.' metacharacter match newline characters, preventing the bypass. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2022-22978" }, "impact_statement": "CVE-2022-22978: Spring Security 5.7.14 is NOT AFFECTED. The vulnerability (RegexRequestMatcher authorization bypass via newline characters in paths) was fixed in upstream commit c6461d61babfcf92febfd0a85785623e53190a8f (May 12, 2022) and was already included in the Spring Security 5.7.14 release (November 18, 2024) before TuxCare onboarded it (March 23, 2026). The target code has Pattern.DOTALL set as the default regex flag, which makes the '.' metacharacter match newline characters, preventing the bypass. This is an upstream fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.14-tuxcare.6" } } ], "timestamp": "2026-11-06T18:18:00.046080+00:00", "status_notes": "Vulnerability CVE-2024-38821 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-web. Prechecker: The upstream fix is already in this version's source history (commit 4ce7cde1). The upstream fix was released in 5.7.13, and version 5.7.14 is a later release of the same line. Advisories: GitHub GHSA-c4q5-6c82-3qpw (fixed in 5.7.13), CVE record (fixed in 5.7.13), Snyk (fixed in 5.7.13).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-38821" }, "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commit 4ce7cde1). The upstream fix was released in 5.7.13, and version 5.7.14 is a later release of the same line. Advisories: GitHub GHSA-c4q5-6c82-3qpw (fixed in 5.7.13), CVE record (fixed in 5.7.13), Snyk (fixed in 5.7.13)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.14-tuxcare.6" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22732 is fixed in version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2026-22732" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.14-tuxcare.6" } } ], "timestamp": "2026-10-15T17:28:00.089399+00:00", "status_notes": "Vulnerability CVE-2026-22747 affects version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-web, and is fixed in 5.7.14-tuxcare.8.", "vulnerability": { "name": "CVE-2026-22747" }, "action_statement": "Vulnerability CVE-2026-22747 affects version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-web, and is fixed in 5.7.14-tuxcare.8." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.14-tuxcare.6" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22754 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-web. According to security advisories CVE-2026-22754 does not affect Spring-Security versions earlier than 7.0.0. This is supported by manual code inspection and proof-of-concept tests ported from the upstream fix commit. CVE-2026-22754 is an access-control bypass caused by PathPatternRequestMatcherFactoryBean.afterPropertiesSet() calling this.builder.basePath(this.basePath) and discarding the return value \u2014 PathPatternRequestMatcher.Builder is immutable/copy-on-modify, so the configured basePath was silently dropped and protected URLs (e.g., /spring/path) were left unmatched by the security filter chain. The vulnerability requires two pieces of infrastructure introduced in Spring Security 7.0.0: 1. The PathPatternRequestMatcher.Builder API (added in upstream commit 3e53cc2c4a, \"Use PathPatternRequestMatcher in config\"). 2. The PathPatternRequestMatcherFactoryBean class itself \u2014 the exact file patched by upstream commit 53bcf0d1 (the CVE fix). Neither piece exists in version 5.7.14. The upstream POC tests (RegexMatcher, CiRegexMatcher + AuthorizationManager variants) were ported verbatim and pass.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22754" }, "impact_statement": "According to security advisories CVE-2026-22754 does not affect Spring-Security versions earlier than 7.0.0. This is supported by manual code inspection and proof-of-concept tests ported from the upstream fix commit. CVE-2026-22754 is an access-control bypass caused by PathPatternRequestMatcherFactoryBean.afterPropertiesSet() calling this.builder.basePath(this.basePath) and discarding the return value \u2014 PathPatternRequestMatcher.Builder is immutable/copy-on-modify, so the configured basePath was silently dropped and protected URLs (e.g., /spring/path) were left unmatched by the security filter chain. The vulnerability requires two pieces of infrastructure introduced in Spring Security 7.0.0: 1. The PathPatternRequestMatcher.Builder API (added in upstream commit 3e53cc2c4a, \"Use PathPatternRequestMatcher in config\"). 2. The PathPatternRequestMatcherFactoryBean class itself \u2014 the exact file patched by upstream commit 53bcf0d1 (the CVE fix). Neither piece exists in version 5.7.14. The upstream POC tests (RegexMatcher, CiRegexMatcher + AuthorizationManager variants) were ported verbatim and pass." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.14-tuxcare.6" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41706 is fixed in version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2026-41706" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.14-tuxcare.6" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47838 is fixed in version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2026-47838" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.7.14-tuxcare.6", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.7.14-tuxcare.6" } } ], "timestamp": "2026-10-30T12:34:56.763245+00:00", "status_notes": "Vulnerability CVE-2026-47841 does not affect version 5.7.14-tuxcare.6 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 5.7.14 contains no WebAuthn code, so it is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47841" }, "impact_statement": "CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 5.7.14 contains no WebAuthn code, so it is not affected." } ] }