{
  "@id": "urn:uuid:caece649-30a7-4434-8a54-4eb259136814",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 48,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T03:31:22.805598+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T12:15:12.464408+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 6.1.21-tuxcare.8 of org.springframework:spring-context. not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity DoS vulnerability in Spring Framework's deserialization of regex patterns. The vulnerability existed when JdkRegexpMethodPointcut stored Pattern[] fields as transient and recompiled them from untrusted strings during deserialization via a custom readObject() method. This allowed attackers to trigger CPU exhaustion through malicious regex pattern...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 describes an algorithmic complexity DoS vulnerability in Spring Framework's deserialization of regex patterns. The vulnerability existed when JdkRegexpMethodPointcut stored Pattern[] fields as transient and recompiled them from untrusted strings during deserialization via a custom readObject() method. This allowed attackers to trigger CPU exhaustion through malicious regex pattern..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T21:30:41.069534+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "action_statement": "Vulnerability CVE-2011-2730 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-29T02:23:11.597840+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "action_statement": "Vulnerability CVE-2011-2894 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T23:41:42.084809+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "action_statement": "Vulnerability CVE-2014-3578 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-29T13:39:01.836668+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "action_statement": "Vulnerability CVE-2015-0201 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T21:27:55.132553+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "action_statement": "Vulnerability CVE-2015-5211 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T21:27:55.132553+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "action_statement": "Vulnerability CVE-2016-5007 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "action_statement": "Vulnerability CVE-2018-11040 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-29T00:51:30.888148+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "action_statement": "Vulnerability CVE-2018-1199 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T09:05:51.109874+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 6.1.21-tuxcare.8 of org.springframework:spring-context. not_affected \u2014 CVE-2018-1257 concerns a regular expression denial of service (ReDoS) vulnerability in Spring Framework's STOMP over WebSocket messaging module, where malicious selector header values in subscription messages could cause excessive CPU consumption during SpEL expression parsing. The target repository (Spring Framework 6.1.21) is not affected because both the original fix (commit ff2228fdaf - add...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1257 concerns a regular expression denial of service (ReDoS) vulnerability in Spring Framework's STOMP over WebSocket messaging module, where malicious selector header values in subscription messages could cause excessive CPU consumption during SpEL expression parsing. The target repository (Spring Framework 6.1.21) is not affected because both the original fix (commit ff2228fdaf - add..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-29T02:48:12.612717+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "action_statement": "Vulnerability CVE-2018-1258 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T18:35:35.339720+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 6.1.21-tuxcare.8 of org.springframework:spring-context. not_affected \u2014 Spring Framework 6.1.21 is not affected by CVE-2018-1271. The vulnerability (Windows directory traversal via backslash path separators) was fixed in upstream Spring Framework by commit 91b803a2310344d925e5d4b1709bbcea90375548 (author: jhoeller@pivotal.io) before version 6.1.21 was released. The target contains both required defenses: backslash-to-forward-slash normalization and rejection of URL...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.21 is not affected by CVE-2018-1271. The vulnerability (Windows directory traversal via backslash path separators) was fixed in upstream Spring Framework by commit 91b803a2310344d925e5d4b1709bbcea90375548 (author: jhoeller@pivotal.io) before version 6.1.21 was released. The target contains both required defenses: backslash-to-forward-slash normalization and rejection of URL..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T21:22:31.131193+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "action_statement": "Vulnerability CVE-2018-1272 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T22:02:19.515243+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "action_statement": "Vulnerability CVE-2018-15756 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-31T03:00:09.428090+00:00",
      "status_notes": "Vulnerability CVE-2022-22950 does not affect version 6.1.21-tuxcare.8 of org.springframework:spring-context. not_affected \u2014 CVE-2022-22950 is not present in Spring Framework 6.1.21. The fix (MAX_ARRAY_ELEMENTS validation to prevent DoS via large array allocation in SpEL expressions) was introduced by upstream commit 83ac6591 (Sam Brannen, 2022-03-08) and was already included in the Spring Framework 6.1.21 release before TuxCare onboarding. The vulnerable pattern - unchecked array dimension values leading to resource...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22950"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22950 is not present in Spring Framework 6.1.21. The fix (MAX_ARRAY_ELEMENTS validation to prevent DoS via large array allocation in SpEL expressions) was introduced by upstream commit 83ac6591 (Sam Brannen, 2022-03-08) and was already included in the Spring Framework 6.1.21 release before TuxCare onboarding. The vulnerable pattern - unchecked array dimension values leading to resource..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T09:01:17.494754+00:00",
      "status_notes": "Vulnerability CVE-2022-22965 does not affect version 6.1.21-tuxcare.8 of org.springframework:spring-context. Spring Framework 6.1.21 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22965"
      },
      "impact_statement": "Spring Framework 6.1.21 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-31T00:53:47.921312+00:00",
      "status_notes": "Vulnerability CVE-2022-22968 does not affect version 6.1.21-tuxcare.8 of org.springframework:spring-context. not_affected \u2014 CVE-2022-22968 is not present in Spring Framework 6.1.21-tuxcare.16. The vulnerability (case-sensitive matching of disallowedFields patterns in DataBinder, allowing attackers to bypass field protections using case variations like \"Id\" instead of \"id\") was fixed in upstream Spring Framework before version 6.1.21 was released. The target contains the fix using PatternMatchUtils.simpleMatchIgnoreC...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22968"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22968 is not present in Spring Framework 6.1.21-tuxcare.16. The vulnerability (case-sensitive matching of disallowedFields patterns in DataBinder, allowing attackers to bypass field protections using case variations like \"Id\" instead of \"id\") was fixed in upstream Spring Framework before version 6.1.21 was released. The target contains the fix using PatternMatchUtils.simpleMatchIgnoreC..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T10:31:18.668108+00:00",
      "status_notes": "Vulnerability CVE-2022-22970 does not affect version 6.1.21-tuxcare.8 of org.springframework:spring-context. not_affected \u2014 Spring Framework 6.1.21 is not affected by CVE-2022-22970. The vulnerability involves resource exhaustion via expensive getter invocations during bean property introspection when MultipartFile or javax.servlet.Part objects are data-bound. The upstream fix (commit 83186b689f by Juergen Hoeller) was already present in Spring Framework 6.1.21 before TuxCare onboarded it. The fix filters read-only ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22970"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.21 is not affected by CVE-2022-22970. The vulnerability involves resource exhaustion via expensive getter invocations during bean property introspection when MultipartFile or javax.servlet.Part objects are data-bound. The upstream fix (commit 83186b689f by Juergen Hoeller) was already present in Spring Framework 6.1.21 before TuxCare onboarded it. The fix filters read-only ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-31T03:31:22.805598+00:00",
      "status_notes": "Vulnerability CVE-2023-20861 does not affect version 6.1.21-tuxcare.8 of org.springframework:spring-context. not_affected \u2014 CVE-2023-20861 affects Spring Framework 6.0.0-6.0.6, 5.3.0-5.3.25, and older versions due to a DoS vulnerability in SpEL expression evaluation. The vulnerability stems from per-instance regex pattern caching in OperatorMatches, allowing attackers to cause resource exhaustion through redundant pattern compilation. The target version 6.1.21-tuxcare.16 is NOT AFFECTED because the upstream fix (com...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20861"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20861 affects Spring Framework 6.0.0-6.0.6, 5.3.0-5.3.25, and older versions due to a DoS vulnerability in SpEL expression evaluation. The vulnerability stems from per-instance regex pattern caching in OperatorMatches, allowing attackers to cause resource exhaustion through redundant pattern compilation. The target version 6.1.21-tuxcare.16 is NOT AFFECTED because the upstream fix (com..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-31T01:25:13.506661+00:00",
      "status_notes": "Vulnerability CVE-2023-20863 does not affect version 6.1.21-tuxcare.8 of org.springframework:spring-context. not_affected \u2014 The target (Spring Framework 6.1.21) is not affected by CVE-2023-20863. The vulnerability was fixed by the upstream Spring Framework team in commit b73f5fcac2 (April 2023) and included in the upstream 6.1.21 release before TuxCare onboarding. The fix adds length validation that rejects SpEL expressions exceeding 10,000 characters, preventing DoS via excessively long expressions. The target impl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20863"
      },
      "impact_statement": "not_affected \u2014 The target (Spring Framework 6.1.21) is not affected by CVE-2023-20863. The vulnerability was fixed by the upstream Spring Framework team in commit b73f5fcac2 (April 2023) and included in the upstream 6.1.21 release before TuxCare onboarding. The fix adds length validation that rejects SpEL expressions exceeding 10,000 characters, preventing DoS via excessively long expressions. The target impl..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-29T03:48:46.502543+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-31T00:19:45.400359+00:00",
      "status_notes": "Vulnerability CVE-2024-38808 does not affect version 6.1.21-tuxcare.8 of org.springframework:spring-context. not_affected \u2014 Spring Framework 6.1.21-tuxcare.16 is NOT AFFECTED by CVE-2024-38808. The vulnerability affects versions 5.3.0-5.3.38 and older. The target version 6.1.21 already contains both upstream fixes (commits e74406afd0 and 0127de5a7a by Sam Brannen) that were shipped in the upstream release before TuxCare onboarded this version. All defense mechanisms are verified present: EvaluationContext.isAssignme...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38808"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.21-tuxcare.16 is NOT AFFECTED by CVE-2024-38808. The vulnerability affects versions 5.3.0-5.3.38 and older. The target version 6.1.21 already contains both upstream fixes (commits e74406afd0 and 0127de5a7a by Sam Brannen) that were shipped in the upstream release before TuxCare onboarded this version. All defense mechanisms are verified present: EvaluationContext.isAssignme..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T04:03:00.114023+00:00",
      "status_notes": "Vulnerability CVE-2024-38820 does not affect version 6.1.21-tuxcare.8 of org.springframework:spring-context. not_affected \u2014 CVE-2024-38820 (locale-dependent toLowerCase bypassing disallowedFields) is NOT present in Spring Framework 6.1.21. The upstream vendor fixed the vulnerability in commit 23656aebc6 (Oct 2024) by using toLowerCase(Locale.ROOT), then refactored to simpleMatchIgnoreCase in commit edfcc6ffb1 (May 2025). Both commits shipped in the upstream 6.1.21 release. The refactored code uses equalsIgnoreCase()...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-38820"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-38820 (locale-dependent toLowerCase bypassing disallowedFields) is NOT present in Spring Framework 6.1.21. The upstream vendor fixed the vulnerability in commit 23656aebc6 (Oct 2024) by using toLowerCase(Locale.ROOT), then refactored to simpleMatchIgnoreCase in commit edfcc6ffb1 (May 2025). Both commits shipped in the upstream 6.1.21 release. The refactored code uses equalsIgnoreCase()..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-22233 does not affect version 6.1.21-tuxcare.8 of org.springframework:spring-context. Version 6.1.21 is not affected by CVE-2025-22233: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: ee62701f5634e904e42e218baad142cea2bcd332\". No backport needed.",
      "vulnerability": {
        "name": "CVE-2025-22233"
      },
      "impact_statement": "Version 6.1.21 is not affected by CVE-2025-22233: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: ee62701f5634e904e42e218baad142cea2bcd332\". No backport needed."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 6.1.21-tuxcare.8 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 6.1.21-tuxcare.8 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2026-41849 does not affect version 6.1.21-tuxcare.8 of org.springframework:spring-context. Spring Framework 6.1.21 builds repeated text with the JDK's String.repeat. If the int size check in OpMultiply overflows, String.repeat rejects the request with an OutOfMemoryError before allocating any memory, so the CVE-2026-41849 denial of service cannot occur. The vendor lists only 5.3.x as affected.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-41849"
      },
      "impact_statement": "Spring Framework 6.1.21 builds repeated text with the JDK's String.repeat. If the int size check in OpMultiply overflows, String.repeat rejects the request with an OutOfMemoryError before allocating any memory, so the CVE-2026-41849 denial of service cannot occur. The vendor lists only 5.3.x as affected."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41850 is fixed in version 6.1.21-tuxcare.8 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2026-41850"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-10-06T10:15:30.574083+00:00",
      "status_notes": "Vulnerability CVE-2026-41851 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context, and is fixed in 6.1.21-tuxcare.14.",
      "vulnerability": {
        "name": "CVE-2026-41851"
      },
      "action_statement": "Vulnerability CVE-2026-41851 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context, and is fixed in 6.1.21-tuxcare.14."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41852 is fixed in version 6.1.21-tuxcare.8 of org.springframework:spring-context.",
      "vulnerability": {
        "name": "CVE-2026-41852"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-47886 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context, and is fixed in 6.1.21-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2026-47886"
      },
      "action_statement": "Vulnerability CVE-2026-47886 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context, and is fixed in 6.1.21-tuxcare.11."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59282 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context, and is fixed in 6.1.21-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2026-59282"
      },
      "action_statement": "Vulnerability CVE-2026-59282 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context, and is fixed in 6.1.21-tuxcare.11."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-context@6.1.21-tuxcare.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59283 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context, and is fixed in 6.1.21-tuxcare.11.",
      "vulnerability": {
        "name": "CVE-2026-59283"
      },
      "action_statement": "Vulnerability CVE-2026-59283 affects version 6.1.21-tuxcare.8 of org.springframework:spring-context, and is fixed in 6.1.21-tuxcare.11."
    }
  ]
}