{
  "@id": "urn:uuid:f17ac2d0-e0e3-40fc-aee8-a11c53aacc00",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 34,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:52:00.102369+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.5-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.5-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T23:52:00.102369+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 5.3.5-tuxcare.1 of org.springframework:spring-framework-bom. not_affected \u2014 CVE-2020-5421 is not present in Spring Framework 5.3.5. The upstream fix (commit eb11c6fa23) was already included in Spring Framework 5.3.0 release (Oct 2020), which TuxCare onboarded. The fix ensures jsessionid path parameters are always removed from request URIs to prevent RFD attack bypass, and this protection is present in the target code at UrlPathHelper.java:635-649 and WebUtils.java:736-...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-5421 is not present in Spring Framework 5.3.5. The upstream fix (commit eb11c6fa23) was already included in Spring Framework 5.3.0 release (Oct 2020), which TuxCare onboarded. The fix ensures jsessionid path parameters are always removed from request URIs to prevent RFD attack bypass, and this protection is present in the target code at UrlPathHelper.java:635-649 and WebUtils.java:736-..."
    }
  ]
}