{
  "@id": "urn:uuid:e2718d3b-60e5-42c2-b064-1b24e0b636d5",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 35,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T20:32:39.227702+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-30T20:32:39.227702+00:00",
      "status_notes": "Vulnerability CVE-2010-1622 does not affect version 5.3.39-tuxcare.7 of org.springframework:spring. not_affected \u2014 CVE-2010-1622 allows remote code execution via HTTP request parameters like `class.classLoader.URLs[0]=jar:...` by exploiting property binding to access ClassLoader. The vulnerability was fixed in Spring Framework commit 3a5af35d37 (May 2010) by upstream developer Juergen Hoeller. This fix was already present in the upstream Spring Framework 5.3.39 release when TuxCare onboarded it. The target ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-1622"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-1622 allows remote code execution via HTTP request parameters like `class.classLoader.URLs[0]=jar:...` by exploiting property binding to access ClassLoader. The vulnerability was fixed in Spring Framework commit 3a5af35d37 (May 2010) by upstream developer Juergen Hoeller. This fix was already present in the upstream Spring Framework 5.3.39 release when TuxCare onboarded it. The target ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.3.39-tuxcare.7 of org.springframework:spring.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.3.39-tuxcare.7 of org.springframework:spring."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.39-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-29T00:40:33.053070+00:00",
      "status_notes": "Vulnerability CVE-2023-20860 affects version 5.3.39-tuxcare.7 of org.springframework:spring.",
      "vulnerability": {
        "name": "CVE-2023-20860"
      },
      "action_statement": "Vulnerability CVE-2023-20860 affects version 5.3.39-tuxcare.7 of org.springframework:spring."
    }
  ]
}