{
  "@id": "urn:uuid:d57b84ff-34c0-4a0f-b4ef-d58847070764",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 32,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T20:46:35.486637+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.32-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.32-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-30T20:46:35.486637+00:00",
      "status_notes": "Vulnerability CVE-2010-1622 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring. not_affected \u2014 Spring Framework 5.3.32 is not affected by CVE-2010-1622. The vulnerability allowed remote code execution via HTTP parameters binding to `class.classLoader.URLs[0]`. Upstream Spring added comprehensive protections in March 2022 (commit 002546b3) that block ALL Class property access except name variants, plus explicitly filter ClassLoader and ProtectionDomain types. These defenses were already p...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-1622"
      },
      "impact_statement": "not_affected \u2014 Spring Framework 5.3.32 is not affected by CVE-2010-1622. The vulnerability allowed remote code execution via HTTP parameters binding to `class.classLoader.URLs[0]`. Upstream Spring added comprehensive protections in March 2022 (commit 002546b3) that block ALL Class property access except name variants, plus explicitly filter ClassLoader and ProtectionDomain types. These defenses were already p..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.32-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.32-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-28T22:31:54.607962+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.3.32-tuxcare.3 of org.springframework:spring.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.3.32-tuxcare.3 of org.springframework:spring."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.32-tuxcare.3",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.32-tuxcare.3"
          }
        }
      ],
      "timestamp": "2026-10-29T00:40:33.053070+00:00",
      "status_notes": "Vulnerability CVE-2023-20860 affects version 5.3.32-tuxcare.3 of org.springframework:spring.",
      "vulnerability": {
        "name": "CVE-2023-20860"
      },
      "action_statement": "Vulnerability CVE-2023-20860 affects version 5.3.32-tuxcare.3 of org.springframework:spring."
    }
  ]
}