{
  "@id": "urn:uuid:423196a9-2bc3-485f-9cb3-ac31847c1eff",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 32,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T20:40:00.357375+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-30T20:40:00.357375+00:00",
      "status_notes": "Vulnerability CVE-2010-1622 does not affect version 5.3.18-tuxcare.2 of org.springframework:spring. not_affected \u2014 CVE-2010-1622 affects Spring Framework 2.5.x through 3.0.x, allowing remote code execution via HTTP parameters targeting class.classLoader.URLs[0]. The target (Spring Framework 5.3.18) is not affected because the upstream fix was applied in 2010 (commit 3a5af35d37 by Juergen Hoeller) and shipped with the upstream release. The defense code at lines 291-294 filters all Class.class properties exce...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-1622"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-1622 affects Spring Framework 2.5.x through 3.0.x, allowing remote code execution via HTTP parameters targeting class.classLoader.URLs[0]. The target (Spring Framework 5.3.18) is not affected because the upstream fix was applied in 2010 (commit 3a5af35d37 by Juergen Hoeller) and shipped with the upstream release. The defense code at lines 291-294 filters all Class.class properties exce..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.3.18-tuxcare.2 of org.springframework:spring.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.3.18-tuxcare.2 of org.springframework:spring."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.18-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.18-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T10:22:56.906704+00:00",
      "status_notes": "Vulnerability CVE-2023-20860 affects version 5.3.18-tuxcare.2 of org.springframework:spring.",
      "vulnerability": {
        "name": "CVE-2023-20860"
      },
      "action_statement": "Vulnerability CVE-2023-20860 affects version 5.3.18-tuxcare.2 of org.springframework:spring."
    }
  ]
}