{
  "@id": "urn:uuid:7f523cff-581f-43f0-8833-ae52f6e7525c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 46,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-05T13:33:27.447324+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.20-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.20-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T02:51:13.727366+00:00",
      "status_notes": "Vulnerability CVE-2022-22950 does not affect version 5.3.20-tuxcare.1 of org.springframework:spring-expression. not_affected \u2014 CVE-2022-22950 is NOT present in Spring Framework 5.3.20. The vulnerability affects versions 5.3.0-5.3.16, and the upstream fix (commit 83ac65915871067c39a4fb255e0d484c785c0c11 by Sam Brannen) was already included in the upstream 5.3.20 release before TuxCare began their maintenance work. The fix adds validation in ConstructorReference.java to limit array creation to 256K elements, preventing D...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22950"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22950 is NOT present in Spring Framework 5.3.20. The vulnerability affects versions 5.3.0-5.3.16, and the upstream fix (commit 83ac65915871067c39a4fb255e0d484c785c0c11 by Sam Brannen) was already included in the upstream 5.3.20 release before TuxCare began their maintenance work. The fix adds validation in ConstructorReference.java to limit array creation to 256K elements, preventing D..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.20-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.20-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-20861 is fixed in version 5.3.20-tuxcare.1 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2023-20861"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.20-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.20-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T13:33:22.185843+00:00",
      "status_notes": "Vulnerability CVE-2023-20863 affects version 5.3.20-tuxcare.1 of org.springframework:spring-expression, and is fixed in 5.3.20-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2023-20863"
      },
      "action_statement": "Vulnerability CVE-2023-20863 affects version 5.3.20-tuxcare.1 of org.springframework:spring-expression, and is fixed in 5.3.20-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.20-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.20-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-38808 is fixed in version 5.3.20-tuxcare.1 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2024-38808"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.20-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.20-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-05T13:33:27.447324+00:00",
      "status_notes": "Vulnerability CVE-2026-41849 affects version 5.3.20-tuxcare.1 of org.springframework:spring-expression, and is fixed in 5.3.20-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41849"
      },
      "action_statement": "Vulnerability CVE-2026-41849 affects version 5.3.20-tuxcare.1 of org.springframework:spring-expression, and is fixed in 5.3.20-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.20-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.20-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-27T11:31:10.461297+00:00",
      "status_notes": "Vulnerability CVE-2026-41850 affects version 5.3.20-tuxcare.1 of org.springframework:spring-expression, and is fixed in 5.3.20-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-41850"
      },
      "action_statement": "Vulnerability CVE-2026-41850 affects version 5.3.20-tuxcare.1 of org.springframework:spring-expression, and is fixed in 5.3.20-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.20-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.20-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41851 affects version 5.3.20-tuxcare.1 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-41851"
      },
      "action_statement": "Vulnerability CVE-2026-41851 affects version 5.3.20-tuxcare.1 of org.springframework:spring-expression."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.20-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.20-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41852 is fixed in version 5.3.20-tuxcare.1 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-41852"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.20-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.20-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47886 is fixed in version 5.3.20-tuxcare.1 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-47886"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.20-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.20-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59283 is fixed in version 5.3.20-tuxcare.1 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-59283"
      }
    }
  ]
}