{
  "@id": "urn:uuid:fd6b1581-9a54-4ca3-853f-c59eca9de18d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 43,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-31T02:57:17.810871+00:00",
      "status_notes": "Vulnerability CVE-2022-22950 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-expression. not_affected \u2014 CVE-2022-22950 is not present in Spring Framework 5.3.37. The vulnerability affecting versions 5.3.0-5.3.16 involves unbounded SpEL array allocation causing denial of service. The fix (commit 83ac659 by Sam Brannen) was shipped in upstream version 5.3.17 and is present in the target's 5.3.37 release. The vulnerable pattern (unchecked array size before allocation) does not exist in the target code.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22950"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22950 is not present in Spring Framework 5.3.37. The vulnerability affecting versions 5.3.0-5.3.16 involves unbounded SpEL array allocation causing denial of service. The fix (commit 83ac659 by Sam Brannen) was shipped in upstream version 5.3.17 and is present in the target's 5.3.37 release. The vulnerable pattern (unchecked array size before allocation) does not exist in the target code."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-31T03:33:25.295640+00:00",
      "status_notes": "Vulnerability CVE-2023-20861 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-expression. not_affected \u2014 Target repository Spring Framework 5.3.37-tuxcare.13 is NOT AFFECTED by CVE-2023-20861. The vulnerability (DoS via redundant regex pattern compilation in SpEL expressions) was fixed in upstream Spring Framework before version 5.3.37 was released. The fix (commit 430fc25a by Sam Brannen, dated 2023-03-17) moved the regex pattern cache from per-OperatorMatches instance to shared parser-level scop...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20861"
      },
      "impact_statement": "not_affected \u2014 Target repository Spring Framework 5.3.37-tuxcare.13 is NOT AFFECTED by CVE-2023-20861. The vulnerability (DoS via redundant regex pattern compilation in SpEL expressions) was fixed in upstream Spring Framework before version 5.3.37 was released. The fix (commit 430fc25a by Sam Brannen, dated 2023-03-17) moved the regex pattern cache from per-OperatorMatches instance to shared parser-level scop..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-31T01:25:13.506661+00:00",
      "status_notes": "Vulnerability CVE-2023-20863 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20863 fix is present in the target Spring Framework 5.3.37-tuxcare.13. The vulnerability (unlimited SpEL expression length causing DoS) has been mitigated by the upstream Spring Framework fix that limits expression length to 10,000 characters. The fix was authored by Sam Brannen (sam@sambrannen.com) and shipped in the upstream Spring Framework 5.3.37 release before TuxCare onboarded it.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20863"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20863 fix is present in the target Spring Framework 5.3.37-tuxcare.13. The vulnerability (unlimited SpEL expression length causing DoS) has been mitigated by the upstream Spring Framework fix that limits expression length to 10,000 characters. The fix was authored by Sam Brannen (sam@sambrannen.com) and shipped in the upstream Spring Framework 5.3.37 release before TuxCare onboarded it."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-21T17:05:46.341264+00:00",
      "status_notes": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2024-38808"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-21T17:05:46.341264+00:00",
      "status_notes": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.13 of org.springframework:spring-expression. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41849"
      },
      "impact_statement": "Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-21T17:05:46.341264+00:00",
      "status_notes": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-41850"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-21T17:05:46.341264+00:00",
      "status_notes": "Vulnerability CVE-2026-41851 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-41851"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-21T17:05:46.341264+00:00",
      "status_notes": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-41852"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-21T17:05:46.341264+00:00",
      "status_notes": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-47886"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-21T17:05:46.341264+00:00",
      "status_notes": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.13 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-59283"
      }
    }
  ]
}