{
  "@id": "urn:uuid:f33992d3-0e07-454f-94d4-7cedc45336c3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 51,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:17:29.431970+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-30T15:44:00.110412+00:00",
      "status_notes": "Vulnerability CVE-2013-6429 does not affect version 5.3.39-tuxcare.13 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.39 is NOT AFFECTED by CVE-2013-6429 (XXE in SourceHttpMessageConverter). The vulnerability pattern is not present because the upstream fix was already shipped in the Spring Framework 5.3.39 release that TuxCare onboarded. Commit 2ae6a6a3415eebc57babcb9d3e5505887eda6d8a by Rossen Stoyanchev at Pivotal disabled external entity processing by default, preventing XXE attacks. Al...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-6429"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.39 is NOT AFFECTED by CVE-2013-6429 (XXE in SourceHttpMessageConverter). The vulnerability pattern is not present because the upstream fix was already shipped in the Spring Framework 5.3.39 release that TuxCare onboarded. Commit 2ae6a6a3415eebc57babcb9d3e5505887eda6d8a by Rossen Stoyanchev at Pivotal disabled external entity processing by default, preventing XXE attacks. Al..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-30T10:52:09.988158+00:00",
      "status_notes": "Vulnerability CVE-2013-6430 does not affect version 5.3.39-tuxcare.13 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 affects JavaScriptUtils.javaScriptEscape in Spring Framework before 3.2.2 due to missing escapes for angle brackets and Unicode line/paragraph separators. The target (Spring Framework 5.3.39) contains the complete upstream fix from commit f5c9fe69a4 (2013-02-15) by Rossen Stoyanchev, which added escapes for <, >, \\u2028, and \\u2029. This fix shipped in Spring Framework 3.2.x and w...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-6430"
      },
      "impact_statement": "not_affected \u2014 CVE-2013-6430 affects JavaScriptUtils.javaScriptEscape in Spring Framework before 3.2.2 due to missing escapes for angle brackets and Unicode line/paragraph separators. The target (Spring Framework 5.3.39) contains the complete upstream fix from commit f5c9fe69a4 (2013-02-15) by Rossen Stoyanchev, which added escapes for <, >, \\u2028, and \\u2029. This fix shipped in Spring Framework 3.2.x and w..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-30T05:56:00.126269+00:00",
      "status_notes": "Vulnerability CVE-2015-3192 does not affect version 5.3.39-tuxcare.13 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 5.3.39 is not affected by CVE-2015-3192. The vulnerability (improper processing of inline DTD declarations causing memory exhaustion) was fixed by upstream Spring in June 2015 (commit d79ec68db4). The fix added a `supportDtd` flag (default false) that configures XML parsers to disallow DOCTYPE declarations via the `disallow-doctype-decl` feature. This fix was already...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-3192"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.39 is not affected by CVE-2015-3192. The vulnerability (improper processing of inline DTD declarations causing memory exhaustion) was fixed by upstream Spring in June 2015 (commit d79ec68db4). The fix added a `supportDtd` flag (default false) that configures XML parsers to disallow DOCTYPE declarations via the `disallow-doctype-decl` feature. This fix was already..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2016-1000027 affects version 5.3.39-tuxcare.13 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required",
      "vulnerability": {
        "name": "CVE-2016-1000027"
      },
      "action_statement": "Vulnerability CVE-2016-1000027 affects version 5.3.39-tuxcare.13 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-03T00:13:52.765465+00:00",
      "status_notes": "Vulnerability CVE-2018-11039 does not affect version 5.3.39-tuxcare.13 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 5.3.39 is NOT AFFECTED by CVE-2018-11039. The vulnerability (unrestricted HTTP method override via HiddenHttpMethodFilter) was fixed in the upstream Spring Framework release before version 5.3.39 was released. Both the Servlet and Reactive variants of HiddenHttpMethodFilter contain the ALLOWED_METHODS allowlist that restricts method override to only PUT, DELETE, and ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-11039"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.39 is NOT AFFECTED by CVE-2018-11039. The vulnerability (unrestricted HTTP method override via HiddenHttpMethodFilter) was fixed in the upstream Spring Framework release before version 5.3.39 was released. Both the Servlet and Reactive variants of HiddenHttpMethodFilter contain the ALLOWED_METHODS allowlist that restricts method override to only PUT, DELETE, and ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-04T09:17:29.431970+00:00",
      "status_notes": "Vulnerability CVE-2021-22118 does not affect version 5.3.39-tuxcare.13 of org.springframework:spring-web. CVE-2021-22118 affects Spring Framework 5.3.x prior to 5.3.7. The target is at version 5.3.39, which includes the upstream fix commits (cce60c479c and 0d0d75e253) that were released in v5.3.7. The fix changes multipart file upload handlers to use Files.createTempDirectory() with random naming instead of predictable directory paths, preventing privilege escalation attacks where attackers could recreate temp directories with malicious permissions. The vulnerable pattern is not present in the target because the fix was already shipped in the upstream Spring Framework release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-22118"
      },
      "impact_statement": "CVE-2021-22118 affects Spring Framework 5.3.x prior to 5.3.7. The target is at version 5.3.39, which includes the upstream fix commits (cce60c479c and 0d0d75e253) that were released in v5.3.7. The fix changes multipart file upload handlers to use Files.createTempDirectory() with random naming instead of predictable directory paths, preventing privilege escalation attacks where attackers could recreate temp directories with malicious permissions. The vulnerable pattern is not present in the target because the fix was already shipped in the upstream Spring Framework release that TuxCare onboarded.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-03T12:29:43.002778+00:00",
      "status_notes": "Vulnerability CVE-2024-22243 does not affect version 5.3.39-tuxcare.13 of org.springframework:spring-web. CVE-2024-22243 (UriComponentsBuilder host parsing bypass) is NOT present in Spring Framework 5.3.39-tuxcare.23. The upstream fix (commit 7ec5c994c1, Feb 2024) was already included in the 5.3.39 release before TuxCare onboarding. The current USERINFO_PATTERN correctly allows square brackets in userinfo, ensuring accurate host extraction and preventing SSRF/open redirect attacks via malformed URLs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.4; >= 6.0.0, < 6.0.17; >= 5.3.0, < 5.3.32; <= 5.2.25.RELEASE), cve.org (>= 6.0.x, < 6.0.17; >= 6.1.x, < 6.1.4; >= 5.3.x, < 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4; >= 5.3.0, < 5.3.32), Snyk (< 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22243"
      },
      "impact_statement": "CVE-2024-22243 (UriComponentsBuilder host parsing bypass) is NOT present in Spring Framework 5.3.39-tuxcare.23. The upstream fix (commit 7ec5c994c1, Feb 2024) was already included in the 5.3.39 release before TuxCare onboarding. The current USERINFO_PATTERN correctly allows square brackets in userinfo, ensuring accurate host extraction and preventing SSRF/open redirect attacks via malformed URLs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.4; >= 6.0.0, < 6.0.17; >= 5.3.0, < 5.3.32; <= 5.2.25.RELEASE), cve.org (>= 6.0.x, < 6.0.17; >= 6.1.x, < 6.1.4; >= 5.3.x, < 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4; >= 5.3.0, < 5.3.32), Snyk (< 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-03T12:46:12.447284+00:00",
      "status_notes": "Vulnerability CVE-2024-22259 does not affect version 5.3.39-tuxcare.13 of org.springframework:spring-web. The target Spring Framework 5.3.39-tuxcare.23 is NOT AFFECTED by CVE-2024-22259. The vulnerability pattern is not present because the upstream fix (commit 297cbae299) shipped in the Spring Framework 5.3.39 release before TuxCare onboarded it. The fix introduces IPv6 bracket validation in UriComponentsBuilder that rejects URLs with unclosed bracket notation, preventing open redirect and SSRF attacks via malformed host parsing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; < 5.3.33), NVD (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5), cve.org (>= 6.1.x, < 6.1.5; >= 6.0.x, < 6.0.18; >= 5.3.x, < 5.3.33; >= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; >= 5.3.0, < 5.3.33), Snyk (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22259"
      },
      "impact_statement": "The target Spring Framework 5.3.39-tuxcare.23 is NOT AFFECTED by CVE-2024-22259. The vulnerability pattern is not present because the upstream fix (commit 297cbae299) shipped in the Spring Framework 5.3.39 release before TuxCare onboarded it. The fix introduces IPv6 bracket validation in UriComponentsBuilder that rejects URLs with unclosed bracket notation, preventing open redirect and SSRF attacks via malformed host parsing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; < 5.3.33), NVD (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5), cve.org (>= 6.1.x, < 6.1.5; >= 6.0.x, < 6.0.18; >= 5.3.x, < 5.3.33; >= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; >= 5.3.0, < 5.3.33), Snyk (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-11-03T12:50:52.202330+00:00",
      "status_notes": "Vulnerability CVE-2024-22262 does not affect version 5.3.39-tuxcare.13 of org.springframework:spring-web. Spring Framework 5.3.39-tuxcare.23 is NOT affected by CVE-2024-22262. The vulnerability involved UriComponentsBuilder parsing URLs with backslash characters in authority components (scheme, userinfo, host, port), which could allow attackers to bypass host validation checks and perform open redirect or SSRF attacks. The fix (commit 7678286fb3) that adds backslash to regex exclusion patterns was already present in upstream release v5.3.34 (authored by brian.clozel@broadcom.com on 2024-04-11). Since the target version 5.3.39 is based on upstream releases that include v5.3.34 and later, the vulnerable code pattern was never present in this TuxCare-maintained version. The fix commit is an ancestor of HEAD and predates the first TuxCare commit (4ce9b2688ea) in the branch history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6), cve.org (>= 6.1.x, < 6.1.6; >= 6.0.x, < 6.0.19; >= 5.3.x, < 5.3.34; >= 6.1.0, < 6.1.6; >= 6.0.0, < 6.0.19; >= 5.3.0, < 5.3.34), Snyk (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22262"
      },
      "impact_statement": "Spring Framework 5.3.39-tuxcare.23 is NOT affected by CVE-2024-22262. The vulnerability involved UriComponentsBuilder parsing URLs with backslash characters in authority components (scheme, userinfo, host, port), which could allow attackers to bypass host validation checks and perform open redirect or SSRF attacks. The fix (commit 7678286fb3) that adds backslash to regex exclusion patterns was already present in upstream release v5.3.34 (authored by brian.clozel@broadcom.com on 2024-04-11). Since the target version 5.3.39 is based on upstream releases that include v5.3.34 and later, the vulnerable code pattern was never present in this TuxCare-maintained version. The fix commit is an ancestor of HEAD and predates the first TuxCare commit (4ce9b2688ea) in the branch history.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6), cve.org (>= 6.1.x, < 6.1.6; >= 6.0.x, < 6.0.19; >= 5.3.x, < 5.3.34; >= 6.1.0, < 6.1.6; >= 6.0.0, < 6.0.19; >= 5.3.0, < 5.3.34), Snyk (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-30T02:30:25.787365+00:00",
      "status_notes": "Vulnerability CVE-2024-38809 does not affect version 5.3.39-tuxcare.13 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 5.3.39 is not affected by CVE-2024-38809. The vulnerable regex-based ETag parsing code has been replaced with an efficient linear state-machine parser. This fix was authored by the upstream Spring Framework maintainer (rossen.stoyanchev@broadcom.com) and shipped in the upstream 5.3.39 release that TuxCare subsequently onboarded. The fix commit (582bfccbb7) predates t...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38809"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.39 is not affected by CVE-2024-38809. The vulnerable regex-based ETag parsing code has been replaced with an efficient linear state-machine parser. This fix was authored by the upstream Spring Framework maintainer (rossen.stoyanchev@broadcom.com) and shipped in the upstream 5.3.39 release that TuxCare subsequently onboarded. The fix commit (582bfccbb7) predates t..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-38820 is fixed in version 5.3.39-tuxcare.13 of org.springframework:spring-web.",
      "vulnerability": {
        "name": "CVE-2024-38820"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-20T10:05:00.136501+00:00",
      "status_notes": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-web 5.3.39-tuxcare.13. direct vulnerability is in Spring Framework project - affected versions are 6.0.5-6.0.27 / 6.1.0-6.1.19 / 6.2.0-6.2.6, version 5.3.39 is not in this range",
      "vulnerability": {
        "name": "CVE-2025-41234"
      },
      "impact_statement": "direct vulnerability is in Spring Framework project - affected versions are 6.0.5-6.0.27 / 6.1.0-6.1.19 / 6.2.0-6.2.6, version 5.3.39 is not in this range"
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41845 is fixed in version 5.3.39-tuxcare.13 of org.springframework:spring-web.",
      "vulnerability": {
        "name": "CVE-2026-41845"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41854 affects version 5.3.39-tuxcare.13 of org.springframework:spring-web, and is fixed in 5.3.39-tuxcare.20.",
      "vulnerability": {
        "name": "CVE-2026-41854"
      },
      "action_statement": "Vulnerability CVE-2026-41854 affects version 5.3.39-tuxcare.13 of org.springframework:spring-web, and is fixed in 5.3.39-tuxcare.20."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-29T13:52:07.805407+00:00",
      "status_notes": "Vulnerability CVE-2026-47885 does not affect version 5.3.39-tuxcare.13 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.39-tuxcare.23 is not affected by CVE-2026-47885. The vulnerable component PartEventHttpMessageReader and the PartEvent API were introduced in Spring Framework 6.0 and do not exist in version 5.3.39. The CVE describes a vulnerability where maxPartSize limits are not enforced when maxInMemorySize is set to -1, but version 5.3.39 uses a different multipart handling architectur...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-47885"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.39-tuxcare.23 is not affected by CVE-2026-47885. The vulnerable component PartEventHttpMessageReader and the PartEvent API were introduced in Spring Framework 6.0 and do not exist in version 5.3.39. The CVE describes a vulnerability where maxPartSize limits are not enforced when maxInMemorySize is set to -1, but version 5.3.39 uses a different multipart handling architectur..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-10-29T12:13:19.219191+00:00",
      "status_notes": "Vulnerability CVE-2026-47889 does not affect version 5.3.39-tuxcare.13 of org.springframework:spring-web. not_affected \u2014 Version 5.3.39 is not affected by CVE-2026-47889. The vulnerability exists only in JettyCoreServerHttpResponse (Jetty 12 Core reactive adapter), which does not exist in this version. Version 5.3.39 uses Jetty 9.4 with a servlet-based adapter (ServletServerHttpResponse) that correctly serializes cookies with the sameSite attribute via ResponseCookie.toString().",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-47889"
      },
      "impact_statement": "not_affected \u2014 Version 5.3.39 is not affected by CVE-2026-47889. The vulnerability exists only in JettyCoreServerHttpResponse (Jetty 12 Core reactive adapter), which does not exist in this version. Version 5.3.39 uses Jetty 9.4 with a servlet-based adapter (ServletServerHttpResponse) that correctly serializes cookies with the sameSite attribute via ResponseCookie.toString()."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59281 affects version 5.3.39-tuxcare.13 of org.springframework:spring-web, and is fixed in 5.3.39-tuxcare.22.",
      "vulnerability": {
        "name": "CVE-2026-59281"
      },
      "action_statement": "Vulnerability CVE-2026-59281 affects version 5.3.39-tuxcare.13 of org.springframework:spring-web, and is fixed in 5.3.39-tuxcare.22."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-web@5.3.39-tuxcare.13"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59314 affects version 5.3.39-tuxcare.13 of org.springframework:spring-web, and is fixed in 5.3.39-tuxcare.23.",
      "vulnerability": {
        "name": "CVE-2026-59314"
      },
      "action_statement": "Vulnerability CVE-2026-59314 affects version 5.3.39-tuxcare.13 of org.springframework:spring-web, and is fixed in 5.3.39-tuxcare.23."
    }
  ]
}