{
  "@id": "urn:uuid:25ea6d00-7986-4d98-b651-cf90a55935ea",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 42,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.25-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.25-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-31T03:04:52.163751+00:00",
      "status_notes": "Vulnerability CVE-2022-22950 does not affect version 5.3.25-tuxcare.5 of org.springframework:spring-expression. not_affected \u2014 CVE-2022-22950 is not present in Spring Framework 5.3.25. The vulnerability (DoS via unbounded SpEL array allocation) was fixed in upstream version 5.3.17 by commit 83ac659158. The target version 5.3.25 was released after the fix and contains the upstream mitigation: MAX_ARRAY_ELEMENTS constant (256K limit) and checkNumElements() validation in ConstructorReference.java. The fix was already in t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22950"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22950 is not present in Spring Framework 5.3.25. The vulnerability (DoS via unbounded SpEL array allocation) was fixed in upstream version 5.3.17 by commit 83ac659158. The target version 5.3.25 was released after the fix and contains the upstream mitigation: MAX_ARRAY_ELEMENTS constant (256K limit) and checkNumElements() validation in ConstructorReference.java. The fix was already in t..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.25-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.25-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-20861 is fixed in version 5.3.25-tuxcare.5 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2023-20861"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.25-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.25-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-20863 is fixed in version 5.3.25-tuxcare.5 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2023-20863"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.25-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.25-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-38808 is fixed in version 5.3.25-tuxcare.5 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2024-38808"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.25-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.25-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41849 affects version 5.3.25-tuxcare.5 of org.springframework:spring-expression, and is fixed in 5.3.25-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-41849"
      },
      "action_statement": "Vulnerability CVE-2026-41849 affects version 5.3.25-tuxcare.5 of org.springframework:spring-expression, and is fixed in 5.3.25-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.25-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.25-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41850 affects version 5.3.25-tuxcare.5 of org.springframework:spring-expression, and is fixed in 5.3.25-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-41850"
      },
      "action_statement": "Vulnerability CVE-2026-41850 affects version 5.3.25-tuxcare.5 of org.springframework:spring-expression, and is fixed in 5.3.25-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.25-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.25-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41851 affects version 5.3.25-tuxcare.5 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-41851"
      },
      "action_statement": "Vulnerability CVE-2026-41851 affects version 5.3.25-tuxcare.5 of org.springframework:spring-expression."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.25-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.25-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41852 affects version 5.3.25-tuxcare.5 of org.springframework:spring-expression, and is fixed in 5.3.25-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-41852"
      },
      "action_statement": "Vulnerability CVE-2026-41852 affects version 5.3.25-tuxcare.5 of org.springframework:spring-expression, and is fixed in 5.3.25-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.25-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.25-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47886 affects version 5.3.25-tuxcare.5 of org.springframework:spring-expression, and is fixed in 5.3.25-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-47886"
      },
      "action_statement": "Vulnerability CVE-2026-47886 affects version 5.3.25-tuxcare.5 of org.springframework:spring-expression, and is fixed in 5.3.25-tuxcare.10."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.25-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.25-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59283 affects version 5.3.25-tuxcare.5 of org.springframework:spring-expression, and is fixed in 5.3.25-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-59283"
      },
      "action_statement": "Vulnerability CVE-2026-59283 affects version 5.3.25-tuxcare.5 of org.springframework:spring-expression, and is fixed in 5.3.25-tuxcare.8."
    }
  ]
}