{
  "@id": "urn:uuid:eee58634-4e18-42ea-98de-7288cc78516c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 3,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T09:03:00.104314+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.1.3.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.1.3.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-04T09:03:00.104314+00:00",
      "status_notes": "Vulnerability CVE-2021-43466 does not affect version 3.1.3.RELEASE-tuxcare.1 of org.thymeleaf:thymeleaf-spring5. CVE-2021-43466 affects thymeleaf-spring5:3.0.12 with template injection leading to RCE. The target repository contains thymeleaf-spring5 at version 3.1.3.RELEASE, which already includes all upstream fixes for this vulnerability. The fixes include: (1) SpringRequestUtils.checkViewNameNotInRequest() that rejects when both view name and request input contain expression syntax, (2) SPELVariableExpressionEvaluator with restriction checks placed BEFORE caching to prevent bypass, and (3) SpringStandardExpressionUtils.containsExternalAccess() detecting dangerous SpEL patterns (new, T(), param, @). All fixes were authored by the upstream Thymeleaf maintainer (daniel.fernandez@11thlabs.org) and shipped in upstream releases 3.0.13/3.0.14, well before the first TuxCare commit in this repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.13.RELEASE), NVD (= 3.0.12), Snyk (< 3.0.13.RELEASE).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-43466"
      },
      "impact_statement": "CVE-2021-43466 affects thymeleaf-spring5:3.0.12 with template injection leading to RCE. The target repository contains thymeleaf-spring5 at version 3.1.3.RELEASE, which already includes all upstream fixes for this vulnerability. The fixes include: (1) SpringRequestUtils.checkViewNameNotInRequest() that rejects when both view name and request input contain expression syntax, (2) SPELVariableExpressionEvaluator with restriction checks placed BEFORE caching to prevent bypass, and (3) SpringStandardExpressionUtils.containsExternalAccess() detecting dangerous SpEL patterns (new, T(), param, @). All fixes were authored by the upstream Thymeleaf maintainer (daniel.fernandez@11thlabs.org) and shipped in upstream releases 3.0.13/3.0.14, well before the first TuxCare commit in this repository.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 3.0.13.RELEASE), NVD (= 3.0.12), Snyk (< 3.0.13.RELEASE)."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.1.3.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.1.3.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40477 affects version 3.1.3.RELEASE-tuxcare.1 of org.thymeleaf:thymeleaf-spring5.",
      "vulnerability": {
        "name": "CVE-2026-40477"
      },
      "action_statement": "Vulnerability CVE-2026-40477 affects version 3.1.3.RELEASE-tuxcare.1 of org.thymeleaf:thymeleaf-spring5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.1.3.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.1.3.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40478 affects version 3.1.3.RELEASE-tuxcare.1 of org.thymeleaf:thymeleaf-spring5.",
      "vulnerability": {
        "name": "CVE-2026-40478"
      },
      "action_statement": "Vulnerability CVE-2026-40478 affects version 3.1.3.RELEASE-tuxcare.1 of org.thymeleaf:thymeleaf-spring5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.1.3.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.thymeleaf/thymeleaf-spring5@3.1.3.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41901 affects version 3.1.3.RELEASE-tuxcare.1 of org.thymeleaf:thymeleaf-spring5, and is fixed in 3.1.3.RELEASE-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-41901"
      },
      "action_statement": "Vulnerability CVE-2026-41901 affects version 3.1.3.RELEASE-tuxcare.1 of org.thymeleaf:thymeleaf-spring5, and is fixed in 3.1.3.RELEASE-tuxcare.2."
    }
  ]
}