{
  "@id": "urn:uuid:8df9351e-efc8-4385-b7e2-0e95d3240ede",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 38,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:36:00.075532+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.37-tuxcare.9",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.37-tuxcare.9"
          }
        }
      ],
      "timestamp": "2026-10-30T23:36:00.075532+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 5.3.37-tuxcare.9 of org.springframework:spring-framework-bom. not_affected \u2014 Spring Framework 5.3.37 is not affected by CVE-2020-5421. The vulnerability affected versions up to 5.2.8 in the 5.2.x line, 5.1.0-5.1.17, 5.0.0-5.0.18, and 4.3.0-4.3.28. The fix for this RFD bypass vulnerability was incorporated into Spring Framework 5.3.0 (released October 2020) as part of the upstream release, before 5.3.37 was created. Both required defense mechanisms are present: (1) jsess...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.37 is not affected by CVE-2020-5421. The vulnerability affected versions up to 5.2.8 in the 5.2.x line, 5.1.0-5.1.17, 5.0.0-5.0.18, and 4.3.0-4.3.28. The fix for this RFD bypass vulnerability was incorporated into Spring Framework 5.3.0 (released October 2020) as part of the upstream release, before 5.3.37 was created. Both required defense mechanisms are present: (1) jsess..."
    }
  ]
}