{
  "@id": "urn:uuid:8a52bf2d-b925-420d-a7d7-6a938ab46411",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 39,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-31T03:12:40.369537+00:00",
      "status_notes": "Vulnerability CVE-2022-22950 does not affect version 6.2.1-tuxcare.4 of org.springframework:spring-expression. not_affected \u2014 CVE-2022-22950 affects Spring Framework 5.3.0-5.3.16, 5.2.0-5.2.19, and older versions. The target is Spring Framework 6.2.1-tuxcare.6. The vulnerability allowed specially crafted SpEL expressions with large array dimensions to cause denial of service via OutOfMemoryError. The upstream fix (commit 83ac65915871067c39a4fb255e0d484c785c0c11 by sbrannen@vmware.com) introduced MAX_ARRAY_ELEMENTS val...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22950"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22950 affects Spring Framework 5.3.0-5.3.16, 5.2.0-5.2.19, and older versions. The target is Spring Framework 6.2.1-tuxcare.6. The vulnerability allowed specially crafted SpEL expressions with large array dimensions to cause denial of service via OutOfMemoryError. The upstream fix (commit 83ac65915871067c39a4fb255e0d484c785c0c11 by sbrannen@vmware.com) introduced MAX_ARRAY_ELEMENTS val..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-31T03:44:09.234090+00:00",
      "status_notes": "Vulnerability CVE-2023-20861 does not affect version 6.2.1-tuxcare.4 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20861 is NOT present in Spring Framework 6.2.1-tuxcare.6. The vulnerability (DoS via redundant regex pattern compilation in SpEL matches operator) was fixed in upstream commit 935c29e3dd by Sam Brannen on 2023-03-17. This fix was already part of the Spring Framework 6.2.1 release that TuxCare onboarded. The fix consolidates regex pattern caches so all matches operators within a SpEL pa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20861"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20861 is NOT present in Spring Framework 6.2.1-tuxcare.6. The vulnerability (DoS via redundant regex pattern compilation in SpEL matches operator) was fixed in upstream commit 935c29e3dd by Sam Brannen on 2023-03-17. This fix was already part of the Spring Framework 6.2.1 release that TuxCare onboarded. The fix consolidates regex pattern caches so all matches operators within a SpEL pa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-31T01:34:59.934070+00:00",
      "status_notes": "Vulnerability CVE-2023-20863 does not affect version 6.2.1-tuxcare.4 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20863 is NOT present in Spring Framework 6.2.1-tuxcare.6. The vulnerability (unbounded SpEL expression length causing DoS) was fixed by upstream Spring Framework in commit b73f5fcac22555f844cf27a7eeb876cb9d7f7f7e, which was already included in the upstream 6.2.1 release when TuxCare onboarded it. The defense (checkExpressionLength method enforcing a 10,000 character limit) is present, ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20863"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20863 is NOT present in Spring Framework 6.2.1-tuxcare.6. The vulnerability (unbounded SpEL expression length causing DoS) was fixed by upstream Spring Framework in commit b73f5fcac22555f844cf27a7eeb876cb9d7f7f7e, which was already included in the upstream 6.2.1 release when TuxCare onboarded it. The defense (checkExpressionLength method enforcing a 10,000 character limit) is present, ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-31T00:32:55.690146+00:00",
      "status_notes": "Vulnerability CVE-2024-38808 does not affect version 6.2.1-tuxcare.4 of org.springframework:spring-expression. not_affected \u2014 CVE-2024-38808 affects Spring Framework 5.3.0-5.3.38 and older versions. The target version 6.2.1 already contains both upstream fixes for this CVE in the onboarded release. The vulnerability involves two attack vectors: (1) bypassing read-only semantics via assignment/increment/decrement operators in SimpleEvaluationContext, and (2) DoS via unrestricted array construction. Both fixes were auth...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38808"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-38808 affects Spring Framework 5.3.0-5.3.38 and older versions. The target version 6.2.1 already contains both upstream fixes for this CVE in the onboarded release. The vulnerability involves two attack vectors: (1) bypassing read-only semantics via assignment/increment/decrement operators in SimpleEvaluationContext, and (2) DoS via unrestricted array construction. Both fixes were auth..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2026-41849 does not affect version 6.2.1-tuxcare.4 of org.springframework:spring-expression. Spring Framework 6.2.1 builds repeated text with the JDK's String.repeat. If the int size check in OpMultiply overflows, String.repeat rejects the request with an OutOfMemoryError before allocating any memory, so the CVE-2026-41849 denial of service cannot occur. The vendor lists only 5.3.x as affected.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-41849"
      },
      "impact_statement": "Spring Framework 6.2.1 builds repeated text with the JDK's String.repeat. If the int size check in OpMultiply overflows, String.repeat rejects the request with an OutOfMemoryError before allocating any memory, so the CVE-2026-41849 denial of service cannot occur. The vendor lists only 5.3.x as affected."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41850 is fixed in version 6.2.1-tuxcare.4 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-41850"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-21T17:19:00.196783+00:00",
      "status_notes": "Vulnerability CVE-2026-41851 affects version 6.2.1-tuxcare.4 of org.springframework:spring-expression, and is fixed in 6.2.1-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-41851"
      },
      "action_statement": "Vulnerability CVE-2026-41851 affects version 6.2.1-tuxcare.4 of org.springframework:spring-expression, and is fixed in 6.2.1-tuxcare.6."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41852 is fixed in version 6.2.1-tuxcare.4 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-41852"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47886 is fixed in version 6.2.1-tuxcare.4 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-47886"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.1-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.1-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59283 is fixed in version 6.2.1-tuxcare.4 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-59283"
      }
    }
  ]
}