{ "@id": "urn:uuid:f7dc516a-8c01-4faa-86d9-6bbf0ff8b6bf", "role": "Document Creator", "author": "https://tuxcare.com", "version": 32, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T15:51:00.040518+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-30T16:22:12.450965+00:00", "status_notes": "Vulnerability CVE-2013-6429 does not affect version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Target version 4.3.4.RELEASE is not affected by CVE-2013-6429. The XXE vulnerability fix was already included in the upstream Spring Framework release. The SourceHttpMessageConverter class contains complete XXE protection with `processExternalEntities` defaulting to false and parser features configured to disable external entity resolution. Fix commit 2ae6a6a3415eebc57babcb9d3e5505887eda6d8a by...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2013-6429" }, "impact_statement": "not_affected \u2014 Target version 4.3.4.RELEASE is not affected by CVE-2013-6429. The XXE vulnerability fix was already included in the upstream Spring Framework release. The SourceHttpMessageConverter class contains complete XXE protection with `processExternalEntities` defaulting to false and parser features configured to disable external entity resolution. Fix commit 2ae6a6a3415eebc57babcb9d3e5505887eda6d8a by..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-30T11:27:00.194931+00:00", "status_notes": "Vulnerability CVE-2013-6430 does not affect version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 does not affect Spring Framework 4.3.4.RELEASE-tuxcare.6. The vulnerability in JavaScriptUtils.javaScriptEscape (missing escape sequences for <, >, U+2028, U+2029 characters) was fixed in the upstream release before TuxCare onboarded version 4.3.4.RELEASE. The target code at spring-web/src/main/java/org/springframework/web/util/JavaScriptUtils.java lines 84-97 contains all four re...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2013-6430" }, "impact_statement": "not_affected \u2014 CVE-2013-6430 does not affect Spring Framework 4.3.4.RELEASE-tuxcare.6. The vulnerability in JavaScriptUtils.javaScriptEscape (missing escape sequences for <, >, U+2028, U+2029 characters) was fixed in the upstream release before TuxCare onboarded version 4.3.4.RELEASE. The target code at spring-web/src/main/java/org/springframework/web/util/JavaScriptUtils.java lines 84-97 contains all four re..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-30T06:37:42.052095+00:00", "status_notes": "Vulnerability CVE-2015-3192 does not affect version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2015-3192 affects Spring Framework before 3.2.14 and 4.x before 4.1.7. The target is Spring Framework 4.3.4.RELEASE-tuxcare.6. The upstream fix (commit d79ec68db4) was authored by Rossen Stoyanchev at Pivotal on June 30, 2015, and was already present in the 4.3.4.RELEASE base version when TuxCare onboarded it. The fix disables DTD processing by default via a supportDtd flag (defaults to fal...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2015-3192" }, "impact_statement": "not_affected \u2014 CVE-2015-3192 affects Spring Framework before 3.2.14 and 4.x before 4.1.7. The target is Spring Framework 4.3.4.RELEASE-tuxcare.6. The upstream fix (commit d79ec68db4) was authored by Rossen Stoyanchev at Pivotal on June 30, 2015, and was already present in the 4.3.4.RELEASE base version when TuxCare onboarded it. The fix disables DTD processing by default via a supportDtd flag (defaults to fal..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-1000027 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "vulnerability": { "name": "CVE-2016-1000027" }, "action_statement": "Vulnerability CVE-2016-1000027 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-11039 is fixed in version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web.", "vulnerability": { "name": "CVE-2018-11039" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-22118 does not affect version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework version 4.3.4.RELEASE is not affected by CVE-2021-22118. The vulnerability affects WebFlux multipart file upload handling, but WebFlux does not exist in version 4.3.4.RELEASE. WebFlux was introduced in Spring Framework 5.0, and the vulnerable components (SynchronossPartHttpMessageReader, DefaultPartHttpMessageReader, FileStorage) are not present in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-22118" }, "impact_statement": "not_affected \u2014 Spring Framework version 4.3.4.RELEASE is not affected by CVE-2021-22118. The vulnerability affects WebFlux multipart file upload handling, but WebFlux does not exist in version 4.3.4.RELEASE. WebFlux was introduced in Spring Framework 5.0, and the vulnerable components (SynchronossPartHttpMessageReader, DefaultPartHttpMessageReader, FileStorage) are not present in this version." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22243 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web, and is fixed in 4.3.4.RELEASE-tuxcare.5.", "vulnerability": { "name": "CVE-2024-22243" }, "action_statement": "Vulnerability CVE-2024-22243 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web, and is fixed in 4.3.4.RELEASE-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22259 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web.", "vulnerability": { "name": "CVE-2024-22259" }, "action_statement": "Vulnerability CVE-2024-22259 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22262 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web.", "vulnerability": { "name": "CVE-2024-22262" }, "action_statement": "Vulnerability CVE-2024-22262 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38809 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web, and is fixed in 4.3.4.RELEASE-tuxcare.3.", "vulnerability": { "name": "CVE-2024-38809" }, "action_statement": "Vulnerability CVE-2024-38809 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web, and is fixed in 4.3.4.RELEASE-tuxcare.3." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38820 does not affect version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Target version 4.3.4.RELEASE is not affected by CVE-2024-38820. This vulnerability specifically addresses locale-dependent behavior in String.toLowerCase() calls introduced by the CVE-2022-22968 fix. The target version does not have the CVE-2022-22968 fix, therefore it lacks the vulnerable code pattern (toLowerCase() without Locale.ROOT) that CVE-2024-38820 addresses.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-38820" }, "impact_statement": "not_affected \u2014 Target version 4.3.4.RELEASE is not affected by CVE-2024-38820. This vulnerability specifically addresses locale-dependent behavior in String.toLowerCase() calls introduced by the CVE-2022-22968 fix. The target version does not have the CVE-2022-22968 fix, therefore it lacks the vulnerable code pattern (toLowerCase() without Locale.ROOT) that CVE-2024-38820 addresses." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-29T03:58:30.759519+00:00", "status_notes": "Vulnerability CVE-2025-41234 does not affect version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Version 4.3.4.RELEASE is NOT affected by CVE-2025-41234. The CVE explicitly requires the use of org.springframework.http.ContentDisposition class (introduced in version 5.0.0.M3 on 2016-11-08, one day after 4.3.4.RELEASE). Version 4.3.4.RELEASE uses an alternative implementation (HttpHeaders.setContentDispositionFormData) that already includes proper defenses: for non-ASCII charset, double-quot...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-41234" }, "impact_statement": "not_affected \u2014 Version 4.3.4.RELEASE is NOT affected by CVE-2025-41234. The CVE explicitly requires the use of org.springframework.http.ContentDisposition class (introduced in version 5.0.0.M3 on 2016-11-08, one day after 4.3.4.RELEASE). Version 4.3.4.RELEASE uses an alternative implementation (HttpHeaders.setContentDispositionFormData) that already includes proper defenses: for non-ASCII charset, double-quot..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41845 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web, and is fixed in 4.3.4.RELEASE-tuxcare.3.", "vulnerability": { "name": "CVE-2026-41845" }, "action_statement": "Vulnerability CVE-2026-41845 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web, and is fixed in 4.3.4.RELEASE-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41854 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web.", "vulnerability": { "name": "CVE-2026-41854" }, "action_statement": "Vulnerability CVE-2026-41854 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-29T15:30:49.741847+00:00", "status_notes": "Vulnerability CVE-2026-47885 does not affect version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 4.3.4.RELEASE predates Spring WebFlux entirely (WebFlux introduced in 5.0). The vulnerable class PartEventHttpMessageReader does not exist in this version. While multipart data is processed via servlet-based Commons FileUpload, the specific vulnerable code path (reactive PartEventHttpMessageReader with flawed maxSize calculation when maxInMemorySize == -1) is architecturally ab...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-47885" }, "impact_statement": "not_affected \u2014 Spring Framework 4.3.4.RELEASE predates Spring WebFlux entirely (WebFlux introduced in 5.0). The vulnerable class PartEventHttpMessageReader does not exist in this version. While multipart data is processed via servlet-based Commons FileUpload, the specific vulnerable code path (reactive PartEventHttpMessageReader with flawed maxSize calculation when maxInMemorySize == -1) is architecturally ab..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-29T12:59:20.584338+00:00", "status_notes": "Vulnerability CVE-2026-47889 does not affect version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 4.3.4.RELEASE is NOT affected by CVE-2026-47889. The vulnerability is specific to WebFlux applications running on the Jetty 12 Core reactive adapter, where JettyCoreServerHttpResponse.getSameSite() was hardcoded to return null, causing response cookies to be serialized without the sameSite attribute. Spring Framework 4.3.4 does not contain the WebFlux reactive module (introduce...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47889" }, "impact_statement": "not_affected \u2014 Spring Framework 4.3.4.RELEASE is NOT affected by CVE-2026-47889. The vulnerability is specific to WebFlux applications running on the Jetty 12 Core reactive adapter, where JettyCoreServerHttpResponse.getSameSite() was hardcoded to return null, causing response cookies to be serialized without the sameSite attribute. Spring Framework 4.3.4 does not contain the WebFlux reactive module (introduce..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59281 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web, and is fixed in 4.3.4.RELEASE-tuxcare.5.", "vulnerability": { "name": "CVE-2026-59281" }, "action_statement": "Vulnerability CVE-2026-59281 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web, and is fixed in 4.3.4.RELEASE-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2", "identifiers": { "purl": "pkg:maven/org.springframework/spring-web@4.3.4.RELEASE-tuxcare.2" } } ], "timestamp": "2026-10-07T17:06:38.401198+00:00", "status_notes": "Vulnerability CVE-2026-59314 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web, and is fixed in 4.3.4.RELEASE-tuxcare.6.", "vulnerability": { "name": "CVE-2026-59314" }, "action_statement": "Vulnerability CVE-2026-59314 affects version 4.3.4.RELEASE-tuxcare.2 of org.springframework:spring-web, and is fixed in 4.3.4.RELEASE-tuxcare.6." } ] }