{
  "@id": "urn:uuid:f60da98b-c6b8-45a3-88e2-5a19d5de7e44",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 35,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:49:23.167523+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@6.1.13-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@6.1.13-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T23:49:23.167523+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 6.1.13-tuxcare.1 of org.springframework:spring-framework-bom. not_affected \u2014 Spring Framework 6.1.13-tuxcare.4 is NOT AFFECTED by CVE-2020-5421 (RFD bypass via jsessionid). The upstream fix (commit eb11c6fa23) was already present in Spring Framework 6.1.13 when TuxCare onboarded it. The vulnerable pattern (missing jsessionid removal from URL paths) is not present in this version. The defense code in UrlPathHelper.removeJsessionid() and WebUtils.parseMatrixVariables() co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 6.1.13-tuxcare.4 is NOT AFFECTED by CVE-2020-5421 (RFD bypass via jsessionid). The upstream fix (commit eb11c6fa23) was already present in Spring Framework 6.1.13 when TuxCare onboarded it. The vulnerable pattern (missing jsessionid removal from URL paths) is not present in this version. The defense code in UrlPathHelper.removeJsessionid() and WebUtils.parseMatrixVariables() co..."
    }
  ]
}