{
  "@id": "urn:uuid:87236a1e-0782-4838-a2aa-44118c417d5d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 29,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T18:18:00.046080+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.4.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.4.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:43:54.437566+00:00",
      "status_notes": "Vulnerability CVE-2021-22112 does not affect version 6.4.3-tuxcare.2 of org.springframework.security:spring-security-web. CVE-2021-22112 affects Spring Security versions 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8, 5.2.x prior to 5.2.9, and older. The vulnerability allows SecurityContext to fail saving when changed multiple times in a single request, enabling privilege escalation. The target version 6.4.3 is NOT AFFECTED because the upstream fix (commit 38e9e8ca52 by Rob Winch, Jan 2021) was already included in the Spring Security 6.4.3 release that TuxCare onboarded. The vulnerable pattern (one-save-per-request guard) has been removed and the fix (isSaveContextInvoked flag enabling multiple saves) is present in HttpSessionSecurityContextRepository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22112"
      },
      "impact_statement": "CVE-2021-22112 affects Spring Security versions 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8, 5.2.x prior to 5.2.9, and older. The vulnerability allows SecurityContext to fail saving when changed multiple times in a single request, enabling privilege escalation. The target version 6.4.3 is NOT AFFECTED because the upstream fix (commit 38e9e8ca52 by Rob Winch, Jan 2021) was already included in the Spring Security 6.4.3 release that TuxCare onboarded. The vulnerable pattern (one-save-per-request guard) has been removed and the fix (isSaveContextInvoked flag enabling multiple saves) is present in HttpSessionSecurityContextRepository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9; >= 5.4.0, < 5.4.4; >= 5.3.0, < 5.3.8; < 5.2.9), NVD (< 5.2.9; >= 5.3.0, < 5.3.8; >= 5.4.0, < 5.4.4), cve.org (>= 5.4, < 5.4.4; >= 5.3, < 5.3.8.RELEASE; >= 5.2, < 5.2.9.RELEASE), Snyk (>= 5.4.0, < 5.4.4; >= 5.3.0.RELEASE, < 5.3.8.RELEASE; < 5.2.9.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.4.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.4.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T12:18:14.184922+00:00",
      "status_notes": "Vulnerability CVE-2022-22978 does not affect version 6.4.3-tuxcare.2 of org.springframework.security:spring-security-web. The target Spring Security 6.4.3 is not affected by CVE-2022-22978. The vulnerability was fixed in upstream Spring Security 5.5.7 (May 2022) by enabling Pattern.DOTALL by default in RegexRequestMatcher. This fix was already present in the upstream 6.4.3 release before TuxCare onboarded it. The vulnerable pattern (DEFAULT = 0 without DOTALL) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22978"
      },
      "impact_statement": "The target Spring Security 6.4.3 is not affected by CVE-2022-22978. The vulnerability was fixed in upstream Spring Security 5.5.7 (May 2022) by enabling Pattern.DOTALL by default in RegexRequestMatcher. This fix was already present in the upstream 6.4.3 release before TuxCare onboarded it. The vulnerable pattern (DEFAULT = 0 without DOTALL) does not exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4; < 5.4.11), NVD (< 5.5.7; >= 5.6.0, < 5.6.4), cve.org (>= 5.4, < 5.4.11; >= 5.5, < 5.5.7; >= 5.6, < 5.6.4), Snyk (< 5.4.11; >= 5.5.0, < 5.5.7; >= 5.6.0, < 5.6.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.4.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.4.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T18:18:00.046080+00:00",
      "status_notes": "Vulnerability CVE-2024-38821 does not affect version 6.4.3-tuxcare.2 of org.springframework.security:spring-security-web. Prechecker: The upstream fix is already in this version's source history (commits 0e257b56, 4ce7cde1). Version 6.4.3 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-c4q5-6c82-3qpw (affected up to 6.3.4), CVE record (affected up to 6.3.4), Snyk (affected up to 6.3.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38821"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 0e257b56, 4ce7cde1). Version 6.4.3 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-c4q5-6c82-3qpw (affected up to 6.3.4), CVE record (affected up to 6.3.4), Snyk (affected up to 6.3.4)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.4.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.4.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22732 is fixed in version 6.4.3-tuxcare.2 of org.springframework.security:spring-security-web.",
      "vulnerability": {
        "name": "CVE-2026-22732"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.4.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.4.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22747 does not affect version 6.4.3-tuxcare.2 of org.springframework.security:spring-security-web. CVE-2026-22747 only affects Spring Security 7.0.0-7.0.4 per spring.io advisory. The vulnerable class SubjectX500PrincipalExtractor does not exist in version 6.4.3; only the legacy SubjectDnX509PrincipalExtractor is present, which the advisory explicitly excludes from scope. Verified via manual code inspection.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22747"
      },
      "impact_statement": "CVE-2026-22747 only affects Spring Security 7.0.0-7.0.4 per spring.io advisory. The vulnerable class SubjectX500PrincipalExtractor does not exist in version 6.4.3; only the legacy SubjectDnX509PrincipalExtractor is present, which the advisory explicitly excludes from scope. Verified via manual code inspection."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.4.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.4.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-22754 does not affect version 6.4.3-tuxcare.2 of org.springframework.security:spring-security-web. According to security advisories CVE-2026-22754 does not affect Spring-Security versions earlier than 7.0.0. This is supported by manual code inspection and proof-of-concept tests ported from the upstream fix commit. CVE-2026-22754 is an access-control bypass caused by PathPatternRequestMatcherFactoryBean.afterPropertiesSet() calling this.builder.basePath(this.basePath) and discarding the return value \u2014 PathPatternRequestMatcher.Builder is immutable/copy-on-modify, so the configured basePath was silently dropped and protected URLs (e.g., /spring/path) were left unmatched by the security filter chain. The vulnerability requires two pieces of infrastructure introduced in Spring Security 7.0.0: 1. The PathPatternRequestMatcher.Builder API (added in upstream commit 3e53cc2c4a, \"Use PathPatternRequestMatcher in config\"). 2. The PathPatternRequestMatcherFactoryBean class itself \u2014 the exact file patched by upstream commit 53bcf0d1 (the CVE fix). Neither piece exists in version 6.4.3. The upstream POC tests (RegexMatcher, CiRegexMatcher + AuthorizationManager variants) were ported verbatim and pass.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22754"
      },
      "impact_statement": "According to security advisories CVE-2026-22754 does not affect Spring-Security versions earlier than 7.0.0. This is supported by manual code inspection and proof-of-concept tests ported from the upstream fix commit. CVE-2026-22754 is an access-control bypass caused by PathPatternRequestMatcherFactoryBean.afterPropertiesSet() calling this.builder.basePath(this.basePath) and discarding the return value \u2014 PathPatternRequestMatcher.Builder is immutable/copy-on-modify, so the configured basePath was silently dropped and protected URLs (e.g., /spring/path) were left unmatched by the security filter chain. The vulnerability requires two pieces of infrastructure introduced in Spring Security 7.0.0: 1. The PathPatternRequestMatcher.Builder API (added in upstream commit 3e53cc2c4a, \"Use PathPatternRequestMatcher in config\"). 2. The PathPatternRequestMatcherFactoryBean class itself \u2014 the exact file patched by upstream commit 53bcf0d1 (the CVE fix). Neither piece exists in version 6.4.3. The upstream POC tests (RegexMatcher, CiRegexMatcher + AuthorizationManager variants) were ported verbatim and pass."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.4.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.4.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41706 affects version 6.4.3-tuxcare.2 of org.springframework.security:spring-security-web, and is fixed in 6.4.3-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41706"
      },
      "action_statement": "Vulnerability CVE-2026-41706 affects version 6.4.3-tuxcare.2 of org.springframework.security:spring-security-web, and is fixed in 6.4.3-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.4.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.4.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47838 affects version 6.4.3-tuxcare.2 of org.springframework.security:spring-security-web, and is fixed in 6.4.3-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-47838"
      },
      "action_statement": "Vulnerability CVE-2026-47838 affects version 6.4.3-tuxcare.2 of org.springframework.security:spring-security-web, and is fixed in 6.4.3-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-web@6.4.3-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-web@6.4.3-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-15T11:34:00.137653+00:00",
      "status_notes": "Vulnerability CVE-2026-47841 affects version 6.4.3-tuxcare.2 of org.springframework.security:spring-security-web, and is fixed in 6.4.3-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-47841"
      },
      "action_statement": "Vulnerability CVE-2026-47841 affects version 6.4.3-tuxcare.2 of org.springframework.security:spring-security-web, and is fixed in 6.4.3-tuxcare.10."
    }
  ]
}