{
  "@id": "urn:uuid:d5ae79ed-4918-470b-a5ce-a339058c77e7",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 36,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T20:32:00.193389+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-30T20:32:00.193389+00:00",
      "status_notes": "Vulnerability CVE-2010-1622 does not affect version 5.3.27-tuxcare.5 of org.springframework:spring. not_affected \u2014 CVE-2010-1622 is NOT present in Spring Framework 5.3.27-tuxcare.10. The vulnerability allowed remote code execution via HTTP parameter binding to class.classLoader.URLs[0]. The upstream fix (commit 3a5af35d37 by Juergen Hoeller, May 2010) blocks the classLoader property during Class introspection and was already present in the Spring Framework 5.3.27 release that TuxCare onboarded. The current ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-1622"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-1622 is NOT present in Spring Framework 5.3.27-tuxcare.10. The vulnerability allowed remote code execution via HTTP parameter binding to class.classLoader.URLs[0]. The upstream fix (commit 3a5af35d37 by Juergen Hoeller, May 2010) blocks the classLoader property during Class introspection and was already present in the Spring Framework 5.3.27 release that TuxCare onboarded. The current ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.3.27-tuxcare.5 of org.springframework:spring.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.3.27-tuxcare.5 of org.springframework:spring."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.5",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.27-tuxcare.5"
          }
        }
      ],
      "timestamp": "2026-10-29T00:40:33.053070+00:00",
      "status_notes": "Vulnerability CVE-2023-20860 affects version 5.3.27-tuxcare.5 of org.springframework:spring.",
      "vulnerability": {
        "name": "CVE-2023-20860"
      },
      "action_statement": "Vulnerability CVE-2023-20860 affects version 5.3.27-tuxcare.5 of org.springframework:spring."
    }
  ]
}