{
  "@id": "urn:uuid:5bd69c37-b6f3-48b9-b7dd-8bde5bb79b67",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:01:00.133094+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-xml@3.1.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-xml@3.1.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-04T09:01:00.133094+00:00",
      "status_notes": "Vulnerability CVE-2019-3773 does not affect version 3.1.8-tuxcare.4 of org.springframework.ws:spring-xml. CVE-2019-3773 (XXE vulnerability) is NOT present in Spring WS 3.1.8-tuxcare.6. The upstream fix (commit 1f05307d6) from December 2018 was already included in the Spring WS 3.1.8 release that TuxCare onboarded in August 2024. The fix replaces all direct XML factory instantiations with secure utility wrappers that disable external entity resolution, DTD support, and external resource loading.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.4; >= 3.0.0, < 3.0.6; < 2.4.4; >= 3.0.0, < 3.0.6), Snyk (< 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE; < 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2019-3773"
      },
      "impact_statement": "CVE-2019-3773 (XXE vulnerability) is NOT present in Spring WS 3.1.8-tuxcare.6. The upstream fix (commit 1f05307d6) from December 2018 was already included in the Spring WS 3.1.8 release that TuxCare onboarded in August 2024. The fix replaces all direct XML factory instantiations with secure utility wrappers that disable external entity resolution, DTD support, and external resource loading.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 2.4.4; >= 3.0.0, < 3.0.6; < 2.4.4; >= 3.0.0, < 3.0.6), Snyk (< 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE; < 2.4.4.RELEASE; >= 3.0.0.RELEASE, < 3.0.6.RELEASE)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.ws/spring-xml@3.1.8-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.ws/spring-xml@3.1.8-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-12T22:00:25.404755+00:00",
      "status_notes": "Vulnerability CVE-2026-40998 is fixed in version 3.1.8-tuxcare.4 of org.springframework.ws:spring-xml.",
      "vulnerability": {
        "name": "CVE-2026-40998"
      }
    }
  ]
}