{
  "@id": "urn:uuid:4203c3f6-3e63-41d2-a2b5-7312f462c7f4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 41,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T17:58:00.190834+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.2.25.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.2.25.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T03:17:48.978358+00:00",
      "status_notes": "Vulnerability CVE-2022-22950 does not affect version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring-expression. not_affected \u2014 Target version 5.2.25.RELEASE is not affected by CVE-2022-22950. The vulnerability (uncontrolled array allocation in SpEL expressions leading to DoS) was fixed in upstream Spring Framework 5.2.20.RELEASE. The target contains the complete fix: MAX_ARRAY_ELEMENTS constant (256K limit), checkNumElements() validation method, and calls to this validation in both 1D and multi-dimensional array creati...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22950"
      },
      "impact_statement": "not_affected \u2014 Target version 5.2.25.RELEASE is not affected by CVE-2022-22950. The vulnerability (uncontrolled array allocation in SpEL expressions leading to DoS) was fixed in upstream Spring Framework 5.2.20.RELEASE. The target contains the complete fix: MAX_ARRAY_ELEMENTS constant (256K limit), checkNumElements() validation method, and calls to this validation in both 1D and multi-dimensional array creati..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.2.25.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.2.25.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T03:47:22.616685+00:00",
      "status_notes": "Vulnerability CVE-2023-20861 does not affect version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20861 is NOT present in Spring Framework 5.2.25.RELEASE. The fix for this DoS vulnerability was already included in the upstream 5.2.25.RELEASE release before TuxCare onboarded it. The vulnerable code pattern (per-instance pattern cache in OperatorMatches) has been replaced with the fixed pattern (shared parser-level pattern cache). The fix commit 52c93b1c4b by Sam Brannen was applied ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20861"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20861 is NOT present in Spring Framework 5.2.25.RELEASE. The fix for this DoS vulnerability was already included in the upstream 5.2.25.RELEASE release before TuxCare onboarded it. The vulnerable code pattern (per-instance pattern cache in OperatorMatches) has been replaced with the fixed pattern (shared parser-level pattern cache). The fix commit 52c93b1c4b by Sam Brannen was applied ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.2.25.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.2.25.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-31T01:40:24.446442+00:00",
      "status_notes": "Vulnerability CVE-2023-20863 does not affect version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20863 affects Spring Framework versions prior to 5.2.24 by allowing denial-of-service through arbitrarily long SpEL expressions. The target version 5.2.25.RELEASE is NOT AFFECTED because the fix was already present in the upstream Spring Framework 5.2.25.RELEASE that TuxCare onboarded. The fix (commit 965a639 by sam@sambrannen.com) adds a 10,000-character limit on SpEL expression lengt...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20863"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20863 affects Spring Framework versions prior to 5.2.24 by allowing denial-of-service through arbitrarily long SpEL expressions. The target version 5.2.25.RELEASE is NOT AFFECTED because the fix was already present in the upstream Spring Framework 5.2.25.RELEASE that TuxCare onboarded. The fix (commit 965a639 by sam@sambrannen.com) adds a 10,000-character limit on SpEL expression lengt..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.2.25.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.2.25.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T18:13:42.721558+00:00",
      "status_notes": "Vulnerability CVE-2024-38808 affects version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2024-38808"
      },
      "action_statement": "Vulnerability CVE-2024-38808 affects version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring-expression."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.2.25.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.2.25.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T18:13:42.721558+00:00",
      "status_notes": "Vulnerability CVE-2026-41849 affects version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-41849"
      },
      "action_statement": "Vulnerability CVE-2026-41849 affects version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring-expression."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.2.25.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.2.25.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-02T17:58:00.190834+00:00",
      "status_notes": "Vulnerability CVE-2026-41850 affects version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring-expression, and is fixed in 5.2.25.RELEASE-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41850"
      },
      "action_statement": "Vulnerability CVE-2026-41850 affects version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring-expression, and is fixed in 5.2.25.RELEASE-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.2.25.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.2.25.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T18:13:42.721558+00:00",
      "status_notes": "Vulnerability CVE-2026-41851 affects version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-41851"
      },
      "action_statement": "Vulnerability CVE-2026-41851 affects version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring-expression."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.2.25.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.2.25.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T18:13:42.721558+00:00",
      "status_notes": "Vulnerability CVE-2026-41852 is fixed in version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-41852"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.2.25.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.2.25.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T18:13:42.721558+00:00",
      "status_notes": "Vulnerability CVE-2026-47886 is fixed in version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-47886"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.2.25.RELEASE-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.2.25.RELEASE-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-21T18:13:42.721558+00:00",
      "status_notes": "Vulnerability CVE-2026-59283 is fixed in version 5.2.25.RELEASE-tuxcare.2 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-59283"
      }
    }
  ]
}