{
  "@id": "urn:uuid:8c5ac956-bf89-4b27-a4ba-ec4b38204464",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 37,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:18:00.046080+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:44:53.933368+00:00",
      "status_notes": "Vulnerability CVE-2021-22112 does not affect version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-web. CVE-2021-22112 affects Spring Security versions where HttpSessionSecurityContextRepository fails to save the SecurityContext when changed multiple times in a single request. The target repository (Spring Security 6.2.8) contains the upstream fix committed by Rob Winch (7cab7b06c5) which shipped in the upstream release before TuxCare onboarding. The vulnerable pattern is absent: the code no longer checks isContextSaved() to prevent multiple saves, and instead uses isSaveContextInvoked flag to track changes and ensure subsequent context modifications are saved correctly.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22112"
      },
      "impact_statement": "CVE-2021-22112 affects Spring Security versions where HttpSessionSecurityContextRepository fails to save the SecurityContext when changed multiple times in a single request. The target repository (Spring Security 6.2.8) contains the upstream fix committed by Rob Winch (7cab7b06c5) which shipped in the upstream release before TuxCare onboarding. The vulnerable pattern is absent: the code no longer checks isContextSaved() to prevent multiple saves, and instead uses isSaveContextInvoked flag to track changes and ensure subsequent context modifications are saved correctly.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:17:09.103452+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-web. The target repository (Spring Security 6.2.8) is NOT affected by CVE-2022-22978. The vulnerability involves RegexRequestMatcher's default regex pattern flags allowing authorization bypass via newline characters in request paths. The fix (adding Pattern.DOTALL flag by default) was already present in upstream release 6.2.8 before TuxCare onboarded it. The vulnerable pattern (DEFAULT = 0) does not exist in the target; instead, the fixed pattern (DEFAULT = Pattern.DOTALL) is present at line 46 of RegexRequestMatcher.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "The target repository (Spring Security 6.2.8) is NOT affected by CVE-2022-22978. The vulnerability involves RegexRequestMatcher's default regex pattern flags allowing authorization bypass via newline characters in request paths. The fix (adding Pattern.DOTALL flag by default) was already present in upstream release 6.2.8 before TuxCare onboarded it. The vulnerable pattern (DEFAULT = 0) does not exist in the target; instead, the fixed pattern (DEFAULT = Pattern.DOTALL) is present at line 46 of RegexRequestMatcher.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-06T18:18:00.046080+00:00",
      "status_notes": "Vulnerability CVE-2024-38821 does not affect version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-web. Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. The upstream fix was released in 6.2.7, and version 6.2.8 is a later release of the same line. Advisories: GitHub GHSA-c4q5-6c82-3qpw (fixed in 6.2.7), CVE record (fixed in 6.2.7), Snyk (fixed in 6.2.7).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38821"
      },
      "impact_statement": "Prechecker: No vulnerable code from the fix was found, and every line the fix adds is already in this version. The upstream fix was released in 6.2.7, and version 6.2.8 is a later release of the same line. Advisories: GitHub GHSA-c4q5-6c82-3qpw (fixed in 6.2.7), CVE record (fixed in 6.2.7), Snyk (fixed in 6.2.7)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22732 is fixed in version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-22732"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22747 affects version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-22747"
      },
      "action_statement": "Vulnerability CVE-2026-22747 affects version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-web."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22754 does not affect version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-web. not_affected \u2014 Version 6.2.8 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean, a class that does not exist in version 6.2.8. Version 6.2.8 uses a completely different architecture (MvcRequestMatcher with property setters) that correctly handles servlet-path configuration without the builder reassignm...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-22754"
      },
      "impact_statement": "not_affected \u2014 Version 6.2.8 is not affected by CVE-2026-22754. The vulnerability exists in Spring Security 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean, a class that does not exist in version 6.2.8. Version 6.2.8 uses a completely different architecture (MvcRequestMatcher with property setters) that correctly handles servlet-path configuration without the builder reassignm..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41706 is fixed in version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-41706"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47838 is fixed in version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-47838"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.2.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T12:34:56.763245+00:00",
      "status_notes": "Vulnerability CVE-2026-47841 does not affect version 6.2.8-tuxcare.4 of org.springframework.security:spring-security-web. CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 6.2.8 contains no WebAuthn code, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-47841"
      },
      "impact_statement": "CVE-2026-47841 is in Spring Security's WebAuthn (passkeys) support, which was added in 6.4. Spring Security 6.2.8 contains no WebAuthn code, so it is not affected."
    }
  ]
}