{
  "@id": "urn:uuid:6df88000-735e-45b3-a2f6-d981c3e44b01",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 34,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-03T12:43:21.485909+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-03T12:43:21.485909+00:00",
      "status_notes": "Vulnerability CVE-2021-22112 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-web. CVE-2021-22112 affects Spring Security versions 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8, 5.2.x prior to 5.2.9, and older versions. The target repository is Spring Security 6.2.2, which already contains the upstream fix (commit 3116369f027) that was introduced in version 6.0.0. The vulnerable pattern (failure to save SecurityContext when changed multiple times in a request) is not present. All fix components are in place: the isSaveContextInvoked tracking field, the modified contextChanged() method, and removal of the save-once guard. This is an upstream fix that shipped with the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22112"
      },
      "impact_statement": "CVE-2021-22112 affects Spring Security versions 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8, 5.2.x prior to 5.2.9, and older versions. The target repository is Spring Security 6.2.2, which already contains the upstream fix (commit 3116369f027) that was introduced in version 6.0.0. The vulnerable pattern (failure to save SecurityContext when changed multiple times in a request) is not present. All fix components are in place: the isSaveContextInvoked tracking field, the modified contextChanged() method, and removal of the save-once guard. This is an upstream fix that shipped with the release, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-11-03T12:17:09.103452+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-web. CVE-2022-22978 is NOT present in Spring Security 6.2.2-tuxcare.9. The vulnerability (RegexRequestMatcher bypass via line terminators) was fixed in the upstream release by enabling Pattern.DOTALL flag. The target code has DEFAULT = Pattern.DOTALL (line 46), ensuring the '.' metacharacter matches newlines and carriage returns, preventing authorization bypass. This is an upstream fix by Rob Winch that shipped in Spring Security 6.2.2 before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "CVE-2022-22978 is NOT present in Spring Security 6.2.2-tuxcare.9. The vulnerability (RegexRequestMatcher bypass via line terminators) was fixed in the upstream release by enabling Pattern.DOTALL flag. The target code has DEFAULT = Pattern.DOTALL (line 46), ensuring the '.' metacharacter matches newlines and carriage returns, preventing authorization bypass. This is an upstream fix by Rob Winch that shipped in Spring Security 6.2.2 before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-15T14:25:03.403405+00:00",
      "status_notes": "Vulnerability CVE-2024-38821 is fixed in version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2024-38821"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-15T14:25:03.403405+00:00",
      "status_notes": "Vulnerability CVE-2026-22732 is fixed in version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-22732"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-15T14:25:03.403405+00:00",
      "status_notes": "Vulnerability CVE-2026-22747 is fixed in version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-22747"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-15T14:25:03.403405+00:00",
      "status_notes": "Vulnerability CVE-2026-22754 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-web. According to security advisories CVE-2026-22754 does not affect Spring-Security versions earlier than 7.0.0. This is supported by manual code inspection and proof-of-concept tests ported from the upstream fix commit. CVE-2026-22754 is an access-control bypass caused by PathPatternRequestMatcherFactoryBean.afterPropertiesSet() calling this.builder.basePath(this.basePath) and discarding the return value \u2014 PathPatternRequestMatcher.Builder is immutable/copy-on-modify, so the configured basePath was silently dropped and protected URLs (e.g., /spring/path) were left unmatched by the security filter chain. The vulnerability requires two pieces of infrastructure introduced in Spring Security 7.0.0: 1. The PathPatternRequestMatcher.Builder API (added in upstream commit 3e53cc2c4a, \"Use PathPatternRequestMatcher in config\"). 2. The PathPatternRequestMatcherFactoryBean class itself \u2014 the exact file patched by upstream commit 53bcf0d1 (the CVE fix). Neither piece exists in version 6.2.2. The upstream POC tests (RegexMatcher, CiRegexMatcher + AuthorizationManager variants) were ported verbatim and pass.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22754"
      },
      "impact_statement": "According to security advisories CVE-2026-22754 does not affect Spring-Security versions earlier than 7.0.0. This is supported by manual code inspection and proof-of-concept tests ported from the upstream fix commit. CVE-2026-22754 is an access-control bypass caused by PathPatternRequestMatcherFactoryBean.afterPropertiesSet() calling this.builder.basePath(this.basePath) and discarding the return value \u2014 PathPatternRequestMatcher.Builder is immutable/copy-on-modify, so the configured basePath was silently dropped and protected URLs (e.g., /spring/path) were left unmatched by the security filter chain. The vulnerability requires two pieces of infrastructure introduced in Spring Security 7.0.0: 1. The PathPatternRequestMatcher.Builder API (added in upstream commit 3e53cc2c4a, \"Use PathPatternRequestMatcher in config\"). 2. The PathPatternRequestMatcherFactoryBean class itself \u2014 the exact file patched by upstream commit 53bcf0d1 (the CVE fix). Neither piece exists in version 6.2.2. The upstream POC tests (RegexMatcher, CiRegexMatcher + AuthorizationManager variants) were ported verbatim and pass."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-15T14:25:03.403405+00:00",
      "status_notes": "Vulnerability CVE-2026-41706 is fixed in version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-41706"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-15T14:25:03.403405+00:00",
      "status_notes": "Vulnerability CVE-2026-47838 is fixed in version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-47838"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.2.2-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.2.2-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T12:34:56.763245+00:00",
      "status_notes": "Vulnerability CVE-2026-47841 does not affect version 6.2.2-tuxcare.8 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 6.2.2 contains no WebAuthn code, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-47841"
      },
      "impact_statement": "CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 6.2.2 contains no WebAuthn code, so it is not affected."
    }
  ]
}