{
  "@id": "urn:uuid:0e415dfe-b51a-4a92-8c3a-436b8b3f51c9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 28,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:46:12.447284+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T12:46:12.447284+00:00",
      "status_notes": "Vulnerability CVE-2021-22112 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-web. Spring Security 6.0.8 is not affected by CVE-2021-22112. The vulnerability (failure to save SecurityContext when changed multiple times in a single request) was fixed in upstream Spring Security 5.4.4 via commit c72a6fac04. This fix was already present in version 6.0.8 when TuxCare onboarded it. The target code contains the complete mitigation: a boolean flag `isSaveContextInvoked` that tracks whether saveContext() has been called, ensuring subsequent context saves are always persisted even if the context reference matches the original.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22112"
      },
      "impact_statement": "Spring Security 6.0.8 is not affected by CVE-2021-22112. The vulnerability (failure to save SecurityContext when changed multiple times in a single request) was fixed in upstream Spring Security 5.4.4 via commit c72a6fac04. This fix was already present in version 6.0.8 when TuxCare onboarded it. The target code contains the complete mitigation: a boolean flag `isSaveContextInvoked` that tracks whether saveContext() has been called, ensuring subsequent context saves are always persisted even if the context reference matches the original.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-11-03T12:18:14.184922+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-web. The target Spring Security 6.0.8 is not affected by CVE-2022-22978. The vulnerability (RegexRequestMatcher not using Pattern.DOTALL flag, allowing newline characters to bypass regex-based authorization rules) was fixed in upstream Spring Security before the 6.0.0 release. The fix commit c6461d61ba by Rob Winch added Pattern.DOTALL to all regex compilations in RegexRequestMatcher. This fix was already present in the upstream 6.0.8 release that TuxCare onboarded (commit 552dddffd6), making the vulnerable code pattern absent from the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "The target Spring Security 6.0.8 is not affected by CVE-2022-22978. The vulnerability (RegexRequestMatcher not using Pattern.DOTALL flag, allowing newline characters to bypass regex-based authorization rules) was fixed in upstream Spring Security before the 6.0.0 release. The fix commit c6461d61ba by Rob Winch added Pattern.DOTALL to all regex compilations in RegexRequestMatcher. This fix was already present in the upstream 6.0.8 release that TuxCare onboarded (commit 552dddffd6), making the vulnerable code pattern absent from the target repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-27T10:37:39.797709+00:00",
      "status_notes": "Vulnerability CVE-2024-38821 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2024-38821"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-27T10:37:39.797709+00:00",
      "status_notes": "Vulnerability CVE-2026-22732 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-22732"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-27T10:37:39.797709+00:00",
      "status_notes": "Vulnerability CVE-2026-22747 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-22747"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-27T10:37:39.797709+00:00",
      "status_notes": "Vulnerability CVE-2026-22754 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcher (introduced in Spring Security 7.0) where basePath configuration is not properly applied. Version 6.0.8 uses MvcRequestMatcher for servlet-path support, which correctly implements the servletPath check and does not have the builder reassignment bug. The vulnerable code patterns from bo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22754"
      },
      "impact_statement": "not_affected \u2014 Spring Security 6.0.8 is not affected by CVE-2026-22754. The vulnerability exists in PathPatternRequestMatcher (introduced in Spring Security 7.0) where basePath configuration is not properly applied. Version 6.0.8 uses MvcRequestMatcher for servlet-path support, which correctly implements the servletPath check and does not have the builder reassignment bug. The vulnerable code patterns from bo..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-27T10:37:39.797709+00:00",
      "status_notes": "Vulnerability CVE-2026-41706 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-41706"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-27T10:37:39.797709+00:00",
      "status_notes": "Vulnerability CVE-2026-47838 is fixed in version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-47838"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.0.8-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T12:34:56.763245+00:00",
      "status_notes": "Vulnerability CVE-2026-47841 does not affect version 6.0.8-tuxcare.5 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 6.0.8 contains no WebAuthn code, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-47841"
      },
      "impact_statement": "CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 6.0.8 contains no WebAuthn code, so it is not affected."
    }
  ]
}