{
  "@id": "urn:uuid:69718d4e-2db8-455c-8ce1-c4fc0857113a",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 41,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.13-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.13-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T03:06:44.315388+00:00",
      "status_notes": "Vulnerability CVE-2022-22950 does not affect version 6.2.13-tuxcare.1 of org.springframework:spring-expression. not_affected \u2014 CVE-2022-22950 is NOT present in Spring Framework 6.2.13. The vulnerability (DoS via large array allocation in SpEL expressions) was fixed in upstream Spring Framework 5.3.17 (March 2022) and is present in all 6.x releases. The fix (MAX_ARRAY_ELEMENTS threshold + checkNumElements validation) shipped in the upstream 6.2.13 release that TuxCare onboarded. This is NOT a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22950"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22950 is NOT present in Spring Framework 6.2.13. The vulnerability (DoS via large array allocation in SpEL expressions) was fixed in upstream Spring Framework 5.3.17 (March 2022) and is present in all 6.x releases. The fix (MAX_ARRAY_ELEMENTS threshold + checkNumElements validation) shipped in the upstream 6.2.13 release that TuxCare onboarded. This is NOT a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.13-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.13-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T03:37:25.273848+00:00",
      "status_notes": "Vulnerability CVE-2023-20861 does not affect version 6.2.13-tuxcare.1 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20861 is NOT present in Spring Framework 6.2.13. The vulnerability involved per-instance regex pattern caches in the SpEL matches operator, causing redundant pattern compilations that could lead to DoS. The fix (shared pattern cache across all matches operations in a parser instance) was introduced by upstream Spring team in commit 935c29e3dd and was already present in the upstream 6.2...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20861"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20861 is NOT present in Spring Framework 6.2.13. The vulnerability involved per-instance regex pattern caches in the SpEL matches operator, causing redundant pattern compilations that could lead to DoS. The fix (shared pattern cache across all matches operations in a parser instance) was introduced by upstream Spring team in commit 935c29e3dd and was already present in the upstream 6.2..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.13-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.13-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T01:33:43.306022+00:00",
      "status_notes": "Vulnerability CVE-2023-20863 does not affect version 6.2.13-tuxcare.1 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20863 affects Spring Framework versions prior to 5.2.24+, 5.3.27+, and 6.0.8+. The target version 6.2.13-tuxcare.4 includes the upstream fix (commit b73f5fcac2) that was shipped in the original Spring Framework 6.2.13 release. The fix adds a maximum expression length check (default 10,000 characters) in InternalSpelExpressionParser.doParseExpression() to prevent DoS attacks via unbound...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20863"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20863 affects Spring Framework versions prior to 5.2.24+, 5.3.27+, and 6.0.8+. The target version 6.2.13-tuxcare.4 includes the upstream fix (commit b73f5fcac2) that was shipped in the original Spring Framework 6.2.13 release. The fix adds a maximum expression length check (default 10,000 characters) in InternalSpelExpressionParser.doParseExpression() to prevent DoS attacks via unbound..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.13-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.13-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T00:27:35.602696+00:00",
      "status_notes": "Vulnerability CVE-2024-38808 does not affect version 6.2.13-tuxcare.1 of org.springframework:spring-expression. not_affected \u2014 CVE-2024-38808 does not affect Spring Framework 6.2.13. The vulnerability affects versions 5.3.0-5.3.38 and older; version 6.2.13 shipped with complete fixes from upstream. Two defense mechanisms are present: (1) isAssignmentEnabled() checks in Assign/OpInc/OpDec AST nodes prevent DoS via assignment operators in read-only contexts; (2) constructor resolver validation in ConstructorReference pre...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38808"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-38808 does not affect Spring Framework 6.2.13. The vulnerability affects versions 5.3.0-5.3.38 and older; version 6.2.13 shipped with complete fixes from upstream. Two defense mechanisms are present: (1) isAssignmentEnabled() checks in Assign/OpInc/OpDec AST nodes prevent DoS via assignment operators in read-only contexts; (2) constructor resolver validation in ConstructorReference pre..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.13-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.13-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2026-41849 does not affect version 6.2.13-tuxcare.1 of org.springframework:spring-expression. Spring Framework 6.2.13 builds repeated text with the JDK's String.repeat. If the int size check in OpMultiply overflows, String.repeat rejects the request with an OutOfMemoryError before allocating any memory, so the CVE-2026-41849 denial of service cannot occur. The vendor lists only 5.3.x as affected.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-41849"
      },
      "impact_statement": "Spring Framework 6.2.13 builds repeated text with the JDK's String.repeat. If the int size check in OpMultiply overflows, String.repeat rejects the request with an OutOfMemoryError before allocating any memory, so the CVE-2026-41849 denial of service cannot occur. The vendor lists only 5.3.x as affected."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.13-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.13-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41850 is fixed in version 6.2.13-tuxcare.1 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-41850"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.13-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.13-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-21T10:38:00.126679+00:00",
      "status_notes": "Vulnerability CVE-2026-41851 affects version 6.2.13-tuxcare.1 of org.springframework:spring-expression, and is fixed in 6.2.13-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41851"
      },
      "action_statement": "Vulnerability CVE-2026-41851 affects version 6.2.13-tuxcare.1 of org.springframework:spring-expression, and is fixed in 6.2.13-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.13-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.13-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41852 is fixed in version 6.2.13-tuxcare.1 of org.springframework:spring-expression.",
      "vulnerability": {
        "name": "CVE-2026-41852"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.13-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.13-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47886 affects version 6.2.13-tuxcare.1 of org.springframework:spring-expression, and is fixed in 6.2.13-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-47886"
      },
      "action_statement": "Vulnerability CVE-2026-47886 affects version 6.2.13-tuxcare.1 of org.springframework:spring-expression, and is fixed in 6.2.13-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-expression@6.2.13-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-expression@6.2.13-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59283 affects version 6.2.13-tuxcare.1 of org.springframework:spring-expression, and is fixed in 6.2.13-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-59283"
      },
      "action_statement": "Vulnerability CVE-2026-59283 affects version 6.2.13-tuxcare.1 of org.springframework:spring-expression, and is fixed in 6.2.13-tuxcare.2."
    }
  ]
}