{
  "@id": "urn:uuid:98523a05-9ffb-4fd2-9fcc-349f341559ee",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 28,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T06:45:00.355025+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T12:48:12.312716+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2009-1190 is a JDK vulnerability in Pattern.compile() affecting JDK versions before 1.6. Spring Framework 4.3.9.RELEASE requires minimum Java SE 6 for runtime (documented in whats-new.adoc), which includes fixes for the underlying algorithmic complexity issue. While PatternEditor still calls Pattern.compile() without input validation, the exploitation requires JDK before 1.6 - an environmen...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 CVE-2009-1190 is a JDK vulnerability in Pattern.compile() affecting JDK versions before 1.6. Spring Framework 4.3.9.RELEASE requires minimum Java SE 6 for runtime (documented in whats-new.adoc), which includes fixes for the underlying algorithmic complexity issue. While PatternEditor still calls Pattern.compile() without input validation, the exploitation requires JDK before 1.6 - an environmen..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:27:55.132553+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm.",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "action_statement": "Vulnerability CVE-2011-2730 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T02:23:11.597840+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm.",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "action_statement": "Vulnerability CVE-2011-2894 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T06:45:00.355025+00:00",
      "status_notes": "Vulnerability CVE-2013-4152 does not affect version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 4.3.9.RELEASE is not affected by CVE-2013-4152 (XXE vulnerability in JAXB marshaller). The vulnerability was fixed in the upstream Spring Framework release before TuxCare onboarded version 4.3.9.RELEASE. The initial fix (commit 7576274874, August 2013) disabled entity reference replacement, and subsequent upstream commits strengthened the protection by disabling DTD support, ex...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-4152"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 4.3.9.RELEASE is not affected by CVE-2013-4152 (XXE vulnerability in JAXB marshaller). The vulnerability was fixed in the upstream Spring Framework release before TuxCare onboarded version 4.3.9.RELEASE. The initial fix (commit 7576274874, August 2013) disabled entity reference replacement, and subsequent upstream commits strengthened the protection by disabling DTD support, ex..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-31T05:28:00.069271+00:00",
      "status_notes": "Vulnerability CVE-2013-7315 does not affect version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm. not_affected \u2014 CVE-2013-7315 (XXE vulnerability in Spring MVC's StAX XMLInputFactory) is not present in this target. The upstream Spring Framework 4.3.9.RELEASE already included comprehensive XXE protections that exceed the original CVE-2013-7315 fix. The fix was shipped in the upstream release before TuxCare onboarded the version, making this an upstream-authored fix rather than a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-7315"
      },
      "impact_statement": "not_affected \u2014 CVE-2013-7315 (XXE vulnerability in Spring MVC's StAX XMLInputFactory) is not present in this target. The upstream Spring Framework 4.3.9.RELEASE already included comprehensive XXE protections that exceed the original CVE-2013-7315 fix. The fix was shipped in the upstream release before TuxCare onboarded the version, making this an upstream-authored fix rather than a TuxCare backport."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T23:41:42.084809+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm.",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "action_statement": "Vulnerability CVE-2014-3578 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T13:39:01.836668+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm.",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "action_statement": "Vulnerability CVE-2015-0201 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:27:55.132553+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm.",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "action_statement": "Vulnerability CVE-2015-5211 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T21:27:55.132553+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm.",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "action_statement": "Vulnerability CVE-2016-5007 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 is fixed in version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm.",
      "vulnerability": {
        "name": "CVE-2018-11040"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-17T09:26:00.163449+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm.",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "action_statement": "Vulnerability CVE-2018-1199 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm, and is fixed in 4.3.9.RELEASE-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "action_statement": "Vulnerability CVE-2018-1257 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm, and is fixed in 4.3.9.RELEASE-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T02:48:12.612717+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm.",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "action_statement": "Vulnerability CVE-2018-1258 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm, and is fixed in 4.3.9.RELEASE-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "action_statement": "Vulnerability CVE-2018-1271 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm, and is fixed in 4.3.9.RELEASE-tuxcare.2."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 is fixed in version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm.",
      "vulnerability": {
        "name": "CVE-2018-1272"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm, and is fixed in 4.3.9.RELEASE-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "action_statement": "Vulnerability CVE-2018-15756 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm, and is fixed in 4.3.9.RELEASE-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-22965 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm, and is fixed in 4.3.9.RELEASE-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2022-22965"
      },
      "action_statement": "Vulnerability CVE-2022-22965 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm, and is fixed in 4.3.9.RELEASE-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2022-22970 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm.",
      "vulnerability": {
        "name": "CVE-2022-22970"
      },
      "action_statement": "Vulnerability CVE-2022-22970 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T03:48:46.502543+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm, and is fixed in 4.3.9.RELEASE-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      },
      "action_statement": "Vulnerability CVE-2025-41249 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm, and is fixed in 4.3.9.RELEASE-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      },
      "action_statement": "Vulnerability CVE-2026-41848 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-oxm@4.3.9.RELEASE-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-06T10:08:48.714784+00:00",
      "status_notes": "Vulnerability CVE-2026-59282 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm, and is fixed in 4.3.9.RELEASE-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-59282"
      },
      "action_statement": "Vulnerability CVE-2026-59282 affects version 4.3.9.RELEASE-tuxcare.1 of org.springframework:spring-oxm, and is fixed in 4.3.9.RELEASE-tuxcare.5."
    }
  ]
}