{
  "@id": "urn:uuid:bbded024-994f-4e43-b8b2-71fe7b190f8e",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 33,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T23:52:32.000163+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-framework-bom@6.1.16-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-framework-bom@6.1.16-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T23:52:32.000163+00:00",
      "status_notes": "Vulnerability CVE-2020-5421 does not affect version 6.1.16-tuxcare.7 of org.springframework:spring-framework-bom. not_affected \u2014 The target Spring Framework 6.1.16 is not affected by CVE-2020-5421. The vulnerability (RFD attack bypass via jsessionid path parameter) was fixed by upstream Spring Framework in commit eb11c6fa23 authored by Rossen Stoyanchev (VMware), and this fix was already present in the upstream 6.1.16 release before TuxCare onboarding. The vulnerable pattern is not present in the target code - jsessionid...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-5421"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 6.1.16 is not affected by CVE-2020-5421. The vulnerability (RFD attack bypass via jsessionid path parameter) was fixed by upstream Spring Framework in commit eb11c6fa23 authored by Rossen Stoyanchev (VMware), and this fix was already present in the upstream 6.1.16 release before TuxCare onboarding. The vulnerable pattern is not present in the target code - jsessionid..."
    }
  ]
}