{
  "@id": "urn:uuid:33646557-8d03-486b-8325-c8aa532069f2",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 36,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:58:00.120730+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@6.0.0-tuxcare.4",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@6.0.0-tuxcare.4"
          }
        }
      ],
      "timestamp": "2026-10-30T23:58:00.120730+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 6.0.0-tuxcare.4 of org.springframework:spring-framework-bom. not_affected \u2014 Spring Framework 6.0.0 is not affected by CVE-2020-5421 (RFD bypass via jsessionid path parameter). The upstream vendor fix that unconditionally removes jsessionid path parameters and excludes them from matrix variable parsing is present in the codebase. The fix was shipped in the upstream release v5.2.10.RELEASE (Oct 2020), well before version 6.0.0. The vulnerable pattern cannot manifest beca...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.0.0 is not affected by CVE-2020-5421 (RFD bypass via jsessionid path parameter). The upstream vendor fix that unconditionally removes jsessionid path parameters and excludes them from matrix variable parsing is present in the codebase. The fix was shipped in the upstream release v5.2.10.RELEASE (Oct 2020), well before version 6.0.0. The vulnerable pattern cannot manifest beca..."
    }
  ]
}