{
  "@id": "urn:uuid:51accdeb-1368-4ba1-a1bf-61b5df01563d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 43,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-31T03:44:58.208288+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T13:00:26.830408+00:00",
      "status_notes": "Vulnerability CVE-2009-1190 does not affect version 5.3.33-tuxcare.3 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework 5.3.33 is not affected by CVE-2009-1190. The vulnerability requires deserializing untrusted data containing malicious regex patterns, which triggers CPU exhaustion via Pattern.compile(). The upstream vendor (Spring) mitigated this by deprecating all serialization-based remoting (HttpInvoker, RMI) in Spring 5.3.0 (July 2020) with explicit warnings against exposing these endpoint...",
      "vulnerability": {
        "name": "CVE-2009-1190"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.33 is not affected by CVE-2009-1190. The vulnerability requires deserializing untrusted data containing malicious regex patterns, which triggers CPU exhaustion via Pattern.compile(). The upstream vendor (Spring) mitigated this by deprecating all serialization-based remoting (HttpInvoker, RMI) in Spring 5.3.0 (July 2020) with explicit warnings against exposing these endpoint..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:27:55.132553+00:00",
      "status_notes": "Vulnerability CVE-2011-2730 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2011-2730"
      },
      "action_statement": "Vulnerability CVE-2011-2730 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T02:23:11.597840+00:00",
      "status_notes": "Vulnerability CVE-2011-2894 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2011-2894"
      },
      "action_statement": "Vulnerability CVE-2011-2894 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T16:52:00.226722+00:00",
      "status_notes": "Vulnerability CVE-2013-6429 does not affect version 5.3.33-tuxcare.3 of org.springframework:spring-websocket. not_affected \u2014 CVE-2013-6429 (XXE vulnerability in SourceHttpMessageConverter) is NOT present in Spring Framework 5.3.33. The fix was shipped in upstream Spring Framework and was already present when TuxCare onboarded version 5.3.33. The code disables external entity resolution by default (processExternalEntities=false) and sets parser features to block XXE attacks in DOM, SAX, and StAX parsing paths.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-6429"
      },
      "impact_statement": "not_affected \u2014 CVE-2013-6429 (XXE vulnerability in SourceHttpMessageConverter) is NOT present in Spring Framework 5.3.33. The fix was shipped in upstream Spring Framework and was already present when TuxCare onboarded version 5.3.33. The code disables external entity resolution by default (processExternalEntities=false) and sets parser features to block XXE attacks in DOM, SAX, and StAX parsing paths."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T11:43:01.475847+00:00",
      "status_notes": "Vulnerability CVE-2013-6430 does not affect version 5.3.33-tuxcare.3 of org.springframework:spring-websocket. not_affected \u2014 CVE-2013-6430 is NOT present in Spring Framework 5.3.33. The vulnerability required improper escaping of four special characters (<, >, \\u2028, \\u2029) in JavaScriptUtils.javaScriptEscape method. The fix was already shipped in the upstream Spring Framework release before TuxCare onboarded version 5.3.33. All four character escapes are present in the target code at lines 79-92 of JavaScriptUtils...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2013-6430"
      },
      "impact_statement": "not_affected \u2014 CVE-2013-6430 is NOT present in Spring Framework 5.3.33. The vulnerability required improper escaping of four special characters (<, >, \\u2028, \\u2029) in JavaScriptUtils.javaScriptEscape method. The fix was already shipped in the upstream Spring Framework release before TuxCare onboarded version 5.3.33. All four character escapes are present in the target code at lines 79-92 of JavaScriptUtils..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T23:41:42.084809+00:00",
      "status_notes": "Vulnerability CVE-2014-3578 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2014-3578"
      },
      "action_statement": "Vulnerability CVE-2014-3578 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T13:39:01.836668+00:00",
      "status_notes": "Vulnerability CVE-2015-0201 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2015-0201"
      },
      "action_statement": "Vulnerability CVE-2015-0201 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T06:52:00.248586+00:00",
      "status_notes": "Vulnerability CVE-2015-3192 does not affect version 5.3.33-tuxcare.3 of org.springframework:spring-websocket. not_affected \u2014 CVE-2015-3192 is not present in Spring Framework 5.3.33. The upstream fix (commit d79ec68db4) that disables DTD processing by default was already included in the 5.3.33 release that TuxCare onboarded. The vulnerable code pattern (unrestricted DTD processing in XML parsers) does not exist in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2015-3192"
      },
      "impact_statement": "not_affected \u2014 CVE-2015-3192 is not present in Spring Framework 5.3.33. The upstream fix (commit d79ec68db4) that disables DTD processing by default was already included in the 5.3.33 release that TuxCare onboarded. The vulnerable code pattern (unrestricted DTD processing in XML parsers) does not exist in the target."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:27:55.132553+00:00",
      "status_notes": "Vulnerability CVE-2015-5211 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2015-5211"
      },
      "action_statement": "Vulnerability CVE-2015-5211 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-21T16:45:51.617996+00:00",
      "status_notes": "Vulnerability CVE-2016-1000027 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required",
      "vulnerability": {
        "name": "CVE-2016-1000027"
      },
      "action_statement": "Vulnerability CVE-2016-1000027 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:27:55.132553+00:00",
      "status_notes": "Vulnerability CVE-2016-5007 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2016-5007"
      },
      "action_statement": "Vulnerability CVE-2016-5007 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:40:33.053070+00:00",
      "status_notes": "Vulnerability CVE-2018-11039 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2018-11039"
      },
      "action_statement": "Vulnerability CVE-2018-11039 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2018-11040 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2018-11040"
      },
      "action_statement": "Vulnerability CVE-2018-11040 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:44:47.675175+00:00",
      "status_notes": "Vulnerability CVE-2018-1199 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2018-1199"
      },
      "action_statement": "Vulnerability CVE-2018-1199 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T10:20:00.109102+00:00",
      "status_notes": "Vulnerability CVE-2018-1257 does not affect version 5.3.33-tuxcare.3 of org.springframework:spring-websocket. not_affected \u2014 The target Spring Framework 5.3.33 is NOT vulnerable to CVE-2018-1257. The vulnerability allowed attackers to craft STOMP subscription messages with malicious \"selector\" headers containing Spring EL expressions that caused ReDoS during parsing. The fix (commit ff2228fdaf by rstoyanchev@pivotal.io, April 2018) was already present in the upstream Spring Framework 5.3.33 release that TuxCare onboa...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1257"
      },
      "impact_statement": "not_affected \u2014 The target Spring Framework 5.3.33 is NOT vulnerable to CVE-2018-1257. The vulnerability allowed attackers to craft STOMP subscription messages with malicious \"selector\" headers containing Spring EL expressions that caused ReDoS during parsing. The fix (commit ff2228fdaf by rstoyanchev@pivotal.io, April 2018) was already present in the upstream Spring Framework 5.3.33 release that TuxCare onboa..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T02:48:12.612717+00:00",
      "status_notes": "Vulnerability CVE-2018-1258 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2018-1258"
      },
      "action_statement": "Vulnerability CVE-2018-1258 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T19:09:00.107947+00:00",
      "status_notes": "Vulnerability CVE-2018-1271 does not affect version 5.3.33-tuxcare.3 of org.springframework:spring-websocket. not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.3.33. The upstream fix (commit 0e28bee0f1 by Rossen Stoyanchev) was already included in the upstream 5.3.33 release before TuxCare onboarded it. The target contains complete defense mechanisms: processPath() normalizes backslashes to forward slashes and removes duplicate slashes; isInvalidEncodedPath() URL-deco...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2018-1271"
      },
      "impact_statement": "not_affected \u2014 CVE-2018-1271 directory traversal vulnerability is NOT present in Spring Framework 5.3.33. The upstream fix (commit 0e28bee0f1 by Rossen Stoyanchev) was already included in the upstream 5.3.33 release before TuxCare onboarded it. The target contains complete defense mechanisms: processPath() normalizes backslashes to forward slashes and removes duplicate slashes; isInvalidEncodedPath() URL-deco..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:22:31.131193+00:00",
      "status_notes": "Vulnerability CVE-2018-1272 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2018-1272"
      },
      "action_statement": "Vulnerability CVE-2018-1272 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:58:36.804623+00:00",
      "status_notes": "Vulnerability CVE-2018-15756 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2018-15756"
      },
      "action_statement": "Vulnerability CVE-2018-15756 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2021-22060 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2021-22060"
      },
      "action_statement": "Vulnerability CVE-2021-22060 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:44:47.675175+00:00",
      "status_notes": "Vulnerability CVE-2021-22118 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2021-22118"
      },
      "action_statement": "Vulnerability CVE-2021-22118 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T03:17:31.624279+00:00",
      "status_notes": "Vulnerability CVE-2022-22950 does not affect version 5.3.33-tuxcare.3 of org.springframework:spring-websocket. not_affected \u2014 CVE-2022-22950 is NOT present in Spring Framework 5.3.33. The vulnerability affects versions 5.3.0-5.3.16, and the fix was introduced in upstream version 5.3.17 (commit 83ac659158). The target version 5.3.33 already contains the upstream fix that limits array element creation to 256K elements, preventing the DoS condition. The fix was shipped in the upstream release when TuxCare onboarded versi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22950"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22950 is NOT present in Spring Framework 5.3.33. The vulnerability affects versions 5.3.0-5.3.16, and the fix was introduced in upstream version 5.3.17 (commit 83ac659158). The target version 5.3.33 already contains the upstream fix that limits array element creation to 256K elements, preventing the DoS condition. The fix was shipped in the upstream release when TuxCare onboarded versi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T08:55:17.845672+00:00",
      "status_notes": "Vulnerability CVE-2022-22965 does not affect version 5.3.33-tuxcare.3 of org.springframework:spring-websocket. Spring Framework 5.3.33 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22965"
      },
      "impact_statement": "Spring Framework 5.3.33 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T01:12:47.453060+00:00",
      "status_notes": "Vulnerability CVE-2022-22968 does not affect version 5.3.33-tuxcare.3 of org.springframework:spring-websocket. not_affected \u2014 The target repository (Spring Framework 5.3.33) is NOT affected by CVE-2022-22968. The vulnerability, which allowed bypassing disallowedFields restrictions through case variation (e.g., \"userId\" vs \"UserId\"), was fixed in upstream version 5.3.19. Version 5.3.33 already contains the upstream fix that makes disallowed field pattern matching case-insensitive, preventing such bypass attacks. The fi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22968"
      },
      "impact_statement": "not_affected \u2014 The target repository (Spring Framework 5.3.33) is NOT affected by CVE-2022-22968. The vulnerability, which allowed bypassing disallowedFields restrictions through case variation (e.g., \"userId\" vs \"UserId\"), was fixed in upstream version 5.3.19. Version 5.3.33 already contains the upstream fix that makes disallowed field pattern matching case-insensitive, preventing such bypass attacks. The fi..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T10:43:51.274656+00:00",
      "status_notes": "Vulnerability CVE-2022-22970 does not affect version 5.3.33-tuxcare.3 of org.springframework:spring-websocket. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 5.3.33. The vulnerability affects versions prior to 5.3.20+, and the upstream fix (commit 83186b689f11f5e6efe7ccc08fdeb92f66fcd583) shipped with v5.3.20 in May 2022. Version 5.3.33, released later, inherited the fix from upstream. The vulnerable pattern (unfiltered introspection of AutoCloseable properties during data binding) has been eliminate...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2022-22970"
      },
      "impact_statement": "not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 5.3.33. The vulnerability affects versions prior to 5.3.20+, and the upstream fix (commit 83186b689f11f5e6efe7ccc08fdeb92f66fcd583) shipped with v5.3.20 in May 2022. Version 5.3.33, released later, inherited the fix from upstream. The vulnerable pattern (unfiltered introspection of AutoCloseable properties during data binding) has been eliminate..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T03:44:58.208288+00:00",
      "status_notes": "Vulnerability CVE-2023-20861 does not affect version 5.3.33-tuxcare.3 of org.springframework:spring-websocket. not_affected \u2014 CVE-2023-20861 affects Spring Framework versions 5.3.0-5.3.25 due to insufficient regex pattern caching in the SpEL matches operator, which could cause DoS through repeated pattern compilation. The target version 5.3.33 is NOT vulnerable because the fix (commit 430fc25aca by Sam Brannen) was already present in the upstream Spring Framework 5.3.26 release. The fix moves the pattern cache from in...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20861"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-20861 affects Spring Framework versions 5.3.0-5.3.25 due to insufficient regex pattern caching in the SpEL matches operator, which could cause DoS through repeated pattern compilation. The target version 5.3.33 is NOT vulnerable because the fix (commit 430fc25aca by Sam Brannen) was already present in the upstream Spring Framework 5.3.26 release. The fix moves the pattern cache from in..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-31T01:38:43.676707+00:00",
      "status_notes": "Vulnerability CVE-2023-20863 does not affect version 5.3.33-tuxcare.3 of org.springframework:spring-websocket. not_affected \u2014 Target version 5.3.33 is not affected by CVE-2023-20863. The upstream Spring Framework fix for SpEL expression length limiting (restricting expressions to 10,000 characters) was already present in the upstream 5.3.33 release when TuxCare onboarded it. The CVE affects versions prior to 5.2.24, 5.3.27, and 6.0.8; since 5.3.33 > 5.3.27, the fix was already incorporated upstream. The fix commit (eb...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-20863"
      },
      "impact_statement": "not_affected \u2014 Target version 5.3.33 is not affected by CVE-2023-20863. The upstream Spring Framework fix for SpEL expression length limiting (restricting expressions to 10,000 characters) was already present in the upstream 5.3.33 release when TuxCare onboarded it. The CVE affects versions prior to 5.2.24, 5.3.27, and 6.0.8; since 5.3.33 > 5.3.27, the fix was already incorporated upstream. The fix commit (eb..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T03:39:22.988337+00:00",
      "status_notes": "Vulnerability CVE-2024-22233 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2024-22233"
      },
      "action_statement": "Vulnerability CVE-2024-22233 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:22:31.131193+00:00",
      "status_notes": "Vulnerability CVE-2024-22243 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2024-22243"
      },
      "action_statement": "Vulnerability CVE-2024-22243 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T21:22:31.131193+00:00",
      "status_notes": "Vulnerability CVE-2024-22259 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2024-22259"
      },
      "action_statement": "Vulnerability CVE-2024-22259 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-21T16:45:51.617996+00:00",
      "status_notes": "Vulnerability CVE-2024-22262 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2024-22262"
      },
      "action_statement": "Vulnerability CVE-2024-22262 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-21T16:45:51.617996+00:00",
      "status_notes": "Vulnerability CVE-2024-38808 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2024-38808"
      },
      "action_statement": "Vulnerability CVE-2024-38808 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-27T10:31:24.194967+00:00",
      "status_notes": "Vulnerability CVE-2024-38809 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket, and is fixed in 5.3.33-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2024-38809"
      },
      "action_statement": "Vulnerability CVE-2024-38809 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket, and is fixed in 5.3.33-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-21T16:45:51.617996+00:00",
      "status_notes": "Vulnerability CVE-2024-38820 is fixed in version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2024-38820"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-21T16:45:51.617996+00:00",
      "status_notes": "Vulnerability CVE-2025-22233 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2025-22233"
      },
      "action_statement": "Vulnerability CVE-2025-22233 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T04:26:13.155457+00:00",
      "status_notes": "Vulnerability CVE-2025-41234 does not affect version 5.3.33-tuxcare.3 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework 5.3.33 is not affected by CVE-2025-41234. The vulnerability exists in the quoted-printable encoding feature, which encodes non-ASCII filenames using RFC 2047 format (=?charset?Q?...). This feature was added in Spring 6.0 (commit 58fbf60d2d, Feb 1 2023) and does not exist in 5.3.33. The target version uses only RFC 5987 percent-encoding for non-ASCII charsets, which properly enc...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2025-41234"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.33 is not affected by CVE-2025-41234. The vulnerability exists in the quoted-printable encoding feature, which encodes non-ASCII filenames using RFC 2047 format (=?charset?Q?...). This feature was added in Spring 6.0 (commit 58fbf60d2d, Feb 1 2023) and does not exist in 5.3.33. The target version uses only RFC 5987 percent-encoding for non-ASCII charsets, which properly enc..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-21T16:45:51.617996+00:00",
      "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2025-41249"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-21T16:45:51.617996+00:00",
      "status_notes": "Vulnerability CVE-2025-41254 is fixed in version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2025-41254"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-21T16:45:51.617996+00:00",
      "status_notes": "Vulnerability CVE-2026-41838 is fixed in version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2026-41838"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-21T16:45:51.617996+00:00",
      "status_notes": "Vulnerability CVE-2026-41845 is fixed in version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2026-41845"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-21T16:45:51.617996+00:00",
      "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2026-41848"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-21T16:45:51.617996+00:00",
      "status_notes": "Vulnerability CVE-2026-41849 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2026-41849"
      },
      "action_statement": "Vulnerability CVE-2026-41849 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-27T10:31:24.194967+00:00",
      "status_notes": "Vulnerability CVE-2026-41850 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket, and is fixed in 5.3.33-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-41850"
      },
      "action_statement": "Vulnerability CVE-2026-41850 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket, and is fixed in 5.3.33-tuxcare.4."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-21T16:45:51.617996+00:00",
      "status_notes": "Vulnerability CVE-2026-41851 is fixed in version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2026-41851"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-21T16:45:51.617996+00:00",
      "status_notes": "Vulnerability CVE-2026-41852 is fixed in version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2026-41852"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-21T16:45:51.617996+00:00",
      "status_notes": "Vulnerability CVE-2026-41854 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2026-41854"
      },
      "action_statement": "Vulnerability CVE-2026-41854 affects version 5.3.33-tuxcare.3 of org.springframework:spring-websocket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T15:30:49.741847+00:00",
      "status_notes": "Vulnerability CVE-2026-47885 does not affect version 5.3.33-tuxcare.3 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework 5.3.33 is not affected by CVE-2026-47885. The vulnerable component, PartEventHttpMessageReader, was introduced in Spring Framework 6.x and does not exist in version 5.3.33. The CVE describes a vulnerability where PartEventHttpMessageReader fails to enforce maxPartSize limits when maxInMemorySize is set to -1. This class and its associated PartEvent API are absent from the 5.3.x...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-47885"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.33 is not affected by CVE-2026-47885. The vulnerable component, PartEventHttpMessageReader, was introduced in Spring Framework 6.x and does not exist in version 5.3.33. The CVE describes a vulnerability where PartEventHttpMessageReader fails to enforce maxPartSize limits when maxInMemorySize is set to -1. This class and its associated PartEvent API are absent from the 5.3.x..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-21T16:45:51.617996+00:00",
      "status_notes": "Vulnerability CVE-2026-47886 is fixed in version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2026-47886"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T13:18:38.056147+00:00",
      "status_notes": "Vulnerability CVE-2026-47889 does not affect version 5.3.33-tuxcare.3 of org.springframework:spring-websocket. not_affected \u2014 Spring Framework 5.3.33-tuxcare.4 is not affected by CVE-2026-47889. The vulnerability is specific to the Jetty 12 Core reactive adapter (JettyCoreServerHttpResponse class), which was introduced in Spring Framework 6.2.0-SNAPSHOT on 2024-01-15. This class does not exist in version 5.3.33. The target uses the servlet-based Jetty adapter (JettyHttpHandlerAdapter) which correctly serializes the sa...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-47889"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.33-tuxcare.4 is not affected by CVE-2026-47889. The vulnerability is specific to the Jetty 12 Core reactive adapter (JettyCoreServerHttpResponse class), which was introduced in Spring Framework 6.2.0-SNAPSHOT on 2024-01-15. This class does not exist in version 5.3.33. The target uses the servlet-based Jetty adapter (JettyHttpHandlerAdapter) which correctly serializes the sa..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-21T16:45:51.617996+00:00",
      "status_notes": "Vulnerability CVE-2026-59281 is fixed in version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2026-59281"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-21T16:45:51.617996+00:00",
      "status_notes": "Vulnerability CVE-2026-59282 is fixed in version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2026-59282"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-21T16:45:51.617996+00:00",
      "status_notes": "Vulnerability CVE-2026-59283 is fixed in version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2026-59283"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring-websocket@5.3.33-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-21T16:45:51.617996+00:00",
      "status_notes": "Vulnerability CVE-2026-59314 is fixed in version 5.3.33-tuxcare.3 of org.springframework:spring-websocket.",
      "vulnerability": {
        "name": "CVE-2026-59314"
      }
    }
  ]
}