{
  "@id": "urn:uuid:12ca052c-ccb2-408c-9e20-c89886bb832f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 32,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:05:51.407283+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T07:50:08.666682+00:00",
      "status_notes": "Vulnerability CVE-2014-0054 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc.",
      "vulnerability": {
        "name": "CVE-2014-0054"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T07:50:08.666682+00:00",
      "status_notes": "Vulnerability CVE-2014-0225 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc.",
      "vulnerability": {
        "name": "CVE-2014-0225"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T07:50:08.666682+00:00",
      "status_notes": "Vulnerability CVE-2014-1904 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc.",
      "vulnerability": {
        "name": "CVE-2014-1904"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T07:50:08.666682+00:00",
      "status_notes": "Vulnerability CVE-2014-3625 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc.",
      "vulnerability": {
        "name": "CVE-2014-3625"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T07:50:08.666682+00:00",
      "status_notes": "Vulnerability CVE-2016-9878 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc.",
      "vulnerability": {
        "name": "CVE-2016-9878"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T12:59:16.129211+00:00",
      "status_notes": "Vulnerability CVE-2020-5397 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is NOT AFFECTED by CVE-2020-5397. The vulnerability exists in CORS (Cross-Origin Resource Sharing) preflight request handling logic, which was not yet implemented in this version. CORS support was introduced in Spring Framework 4.2.0 (April-July 2015), over 3 years after the 3.1.1.RELEASE (February 2012). Without CORS functionality, the vulnerable code pattern (im...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2020-5397"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 3.1.1.RELEASE is NOT AFFECTED by CVE-2020-5397. The vulnerability exists in CORS (Cross-Origin Resource Sharing) preflight request handling logic, which was not yet implemented in this version. CORS support was introduced in Spring Framework 4.2.0 (April-July 2015), over 3 years after the 3.1.1.RELEASE (February 2012). Without CORS functionality, the vulnerable code pattern (im..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T00:36:14.768306+00:00",
      "status_notes": "Vulnerability CVE-2020-5398 affects version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc.",
      "vulnerability": {
        "name": "CVE-2020-5398"
      },
      "action_statement": "Vulnerability CVE-2020-5398 affects version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T07:50:08.666682+00:00",
      "status_notes": "Vulnerability CVE-2022-22965 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc.",
      "vulnerability": {
        "name": "CVE-2022-22965"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T00:40:33.053070+00:00",
      "status_notes": "Vulnerability CVE-2023-20860 affects version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc.",
      "vulnerability": {
        "name": "CVE-2023-20860"
      },
      "action_statement": "Vulnerability CVE-2023-20860 affects version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-11-03T10:04:00.165195+00:00",
      "status_notes": "Vulnerability CVE-2023-34053 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2023-34053. This DoS vulnerability involves unbounded allocation of metric dimension objects when processing arbitrary HTTP method names through Spring's Micrometer observation conventions. However, the entire observation/micrometer integration feature did not exist in Spring Framework 3.1.1 (released ~2012). The vulnerability requires class...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34053"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2023-34053. This DoS vulnerability involves unbounded allocation of metric dimension objects when processing arbitrary HTTP method names through Spring's Micrometer observation conventions. However, the entire observation/micrometer integration feature did not exist in Spring Framework 3.1.1 (released ~2012). The vulnerability requires class..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T00:40:33.053070+00:00",
      "status_notes": "Vulnerability CVE-2024-38816 affects version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc.",
      "vulnerability": {
        "name": "CVE-2024-38816"
      },
      "action_statement": "Vulnerability CVE-2024-38816 affects version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T07:50:08.666682+00:00",
      "status_notes": "Vulnerability CVE-2024-38819 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc.",
      "vulnerability": {
        "name": "CVE-2024-38819"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T07:50:08.666682+00:00",
      "status_notes": "Vulnerability CVE-2024-38828 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc.",
      "vulnerability": {
        "name": "CVE-2024-38828"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T07:53:00.128797+00:00",
      "status_notes": "Vulnerability CVE-2025-41242 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc.",
      "vulnerability": {
        "name": "CVE-2025-41242"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T07:50:08.666682+00:00",
      "status_notes": "Vulnerability CVE-2026-22735 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. Server-sent event support was introduced in Spring Framework 4.2.0; 3.1.1.RELEASE does not contain the vulnerable component.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22735"
      },
      "impact_statement": "Server-sent event support was introduced in Spring Framework 4.2.0; 3.1.1.RELEASE does not contain the vulnerable component."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T07:50:08.666682+00:00",
      "status_notes": "Vulnerability CVE-2026-22737 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. Script template views were introduced in Spring Framework 4.2.0; 3.1.1.RELEASE does not contain the vulnerable component.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22737"
      },
      "impact_statement": "Script template views were introduced in Spring Framework 4.2.0; 3.1.1.RELEASE does not contain the vulnerable component."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T07:50:08.666682+00:00",
      "status_notes": "Vulnerability CVE-2026-22741 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2026-22741. The vulnerable component (CachingResourceResolver) and the resource chain infrastructure were not introduced until Spring Framework 4.1.0.RC1. Version 3.0.5 uses a simpler ResourceHttpRequestHandler that resolves resources on every request without application-level caching, making the cache poisoning attack described in the CVE i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22741"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2026-22741. The vulnerable component (CachingResourceResolver) and the resource chain infrastructure were not introduced until Spring Framework 4.1.0.RC1. Version 3.0.5 uses a simpler ResourceHttpRequestHandler that resolves resources on every request without application-level caching, making the cache poisoning attack described in the CVE i..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T07:53:00.128797+00:00",
      "status_notes": "Vulnerability CVE-2026-22745 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc.",
      "vulnerability": {
        "name": "CVE-2026-22745"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T07:50:08.666682+00:00",
      "status_notes": "Vulnerability CVE-2026-41841 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1 does not contain the vulnerable CachingResourceResolver class or any server-side caching mechanism for static resource resolution. The vulnerability (CVE-2026-41841) is specific to the caching resolver feature introduced in Spring 4.1.0, approximately 2-3 years after this version was released.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41841"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 3.1.1 does not contain the vulnerable CachingResourceResolver class or any server-side caching mechanism for static resource resolution. The vulnerability (CVE-2026-41841) is specific to the caching resolver feature introduced in Spring 4.1.0, approximately 2-3 years after this version was released."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T07:50:08.666682+00:00",
      "status_notes": "Vulnerability CVE-2026-41842 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1 is NOT affected by CVE-2026-41842. The vulnerability exists in content-based version strategies for static resource handling, a feature introduced in Spring Framework 4.1 (2014). Spring 3.1.1 (2011) predates this feature and contains no version removal logic in resource handling.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41842"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 3.1.1 is NOT affected by CVE-2026-41842. The vulnerability exists in content-based version strategies for static resource handling, a feature introduced in Spring Framework 4.1 (2014). Spring 3.1.1 (2011) predates this feature and contains no version removal logic in resource handling."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T07:50:08.666682+00:00",
      "status_notes": "Vulnerability CVE-2026-41843 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2026-41843. The vulnerability requires the content-based version strategy feature (VersionResourceResolver, AbstractVersionStrategy, etc.) which was introduced in Spring Framework 4.1+. This feature does not exist in version 3.1.1, making the attack chain impossible.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41843"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2026-41843. The vulnerability requires the content-based version strategy feature (VersionResourceResolver, AbstractVersionStrategy, etc.) which was introduced in Spring Framework 4.1+. This feature does not exist in version 3.1.1, making the attack chain impossible."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T07:53:00.128797+00:00",
      "status_notes": "Vulnerability CVE-2026-41844 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc.",
      "vulnerability": {
        "name": "CVE-2026-41844"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T07:50:08.666682+00:00",
      "status_notes": "Vulnerability CVE-2026-41845 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE (2012) predates the ECMAScript 6 specification (2015) that introduced template literal syntax. While the code lacks escaping for backtick (`) and dollar sign ($) characters in JavaScriptUtils.javaScriptEscape(), these unescaped characters cannot lead to arbitrary JavaScript code execution in the pre-ES6 JavaScript environment this version was designed for. The att...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-41845"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 3.1.1.RELEASE (2012) predates the ECMAScript 6 specification (2015) that introduced template literal syntax. While the code lacks escaping for backtick (`) and dollar sign ($) characters in JavaScriptUtils.javaScriptEscape(), these unescaped characters cannot lead to arbitrary JavaScript code execution in the pre-ES6 JavaScript environment this version was designed for. The att..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T07:53:00.128797+00:00",
      "status_notes": "Vulnerability CVE-2026-41846 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc.",
      "vulnerability": {
        "name": "CVE-2026-41846"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T07:50:08.666682+00:00",
      "status_notes": "Vulnerability CVE-2026-41853 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1 is not affected by CVE-2026-41853. This version predates the affected version range (5.3.0+) and lacks the vulnerable components. Spring 3.1.1 does not implement custom multipart boundary parsing; it delegates all multipart parsing to external libraries (Apache Commons FileUpload or Servlet 3.0 Part API). The CVE specifically mentions 'Spring MVC and WebFlux' - WebFlux wa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41853"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 3.1.1 is not affected by CVE-2026-41853. This version predates the affected version range (5.3.0+) and lacks the vulnerable components. Spring 3.1.1 does not implement custom multipart boundary parsing; it delegates all multipart parsing to external libraries (Apache Commons FileUpload or Servlet 3.0 Part API). The CVE specifically mentions 'Spring MVC and WebFlux' - WebFlux wa..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T11:08:10.508617+00:00",
      "status_notes": "Vulnerability CVE-2026-47883 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2026-47883. The vulnerable component (UrlHandlerFilter) does not exist in this version. UrlHandlerFilter was introduced in Spring Framework 6.2+, approximately 10+ years after version 3.1.1.RELEASE (2012). The target repository contains no references to UrlHandlerFilter, and TuxCare has only backported fixes for this CVE to 6.2.x branches wh...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-47883"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2026-47883. The vulnerable component (UrlHandlerFilter) does not exist in this version. UrlHandlerFilter was introduced in Spring Framework 6.2+, approximately 10+ years after version 3.1.1.RELEASE (2012). The target repository contains no references to UrlHandlerFilter, and TuxCare has only backported fixes for this CVE to 6.2.x branches wh..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T07:53:00.128797+00:00",
      "status_notes": "Vulnerability CVE-2026-47884 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc.",
      "vulnerability": {
        "name": "CVE-2026-47884"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-09T07:53:00.128797+00:00",
      "status_notes": "Vulnerability CVE-2026-47887 is fixed in version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc.",
      "vulnerability": {
        "name": "CVE-2026-47887"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2026-47890 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. CVE-2026-47890 affects rendering of view fragments as Server-Sent Events, a feature added in Spring Framework 6.2.0. Spring Framework 3.1.1.RELEASE does not contain fragment rendering, so it is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-47890"
      },
      "impact_statement": "CVE-2026-47890 affects rendering of view fragments as Server-Sent Events, a feature added in Spring Framework 6.2.0. Spring Framework 3.1.1.RELEASE does not contain fragment rendering, so it is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-29T10:21:18.524281+00:00",
      "status_notes": "Vulnerability CVE-2026-59313 does not affect version 3.1.1.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2026-59313. This vulnerability requires Spring MVC's functional web framework (RouterFunction, ServerResponse.sse()) for Server-Sent Events, which was introduced in Spring 5.0 (2017). The target version 3.1.1.RELEASE (2012) predates this feature by 5 years and contains no SSE-related code. The SSE support itself (SseEmitter) was first introd...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59313"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2026-59313. This vulnerability requires Spring MVC's functional web framework (RouterFunction, ServerResponse.sse()) for Server-Sent Events, which was introduced in Spring 5.0 (2017). The target version 3.1.1.RELEASE (2012) predates this feature by 5 years and contains no SSE-related code. The SSE support itself (SseEmitter) was first introd..."
    }
  ]
}