{
  "@id": "urn:uuid:00281024-8b5c-4393-b3d8-53a20bde2eca",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 35,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T20:32:39.227702+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.39.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.39.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-30T20:32:39.227702+00:00",
      "status_notes": "Vulnerability CVE-2010-1622 does not affect version 5.3.39.tuxcare of org.springframework:spring. not_affected \u2014 CVE-2010-1622 allows remote code execution via HTTP request parameters like `class.classLoader.URLs[0]=jar:...` by exploiting property binding to access ClassLoader. The vulnerability was fixed in Spring Framework commit 3a5af35d37 (May 2010) by upstream developer Juergen Hoeller. This fix was already present in the upstream Spring Framework 5.3.39 release when TuxCare onboarded it. The target ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2010-1622"
      },
      "impact_statement": "not_affected \u2014 CVE-2010-1622 allows remote code execution via HTTP request parameters like `class.classLoader.URLs[0]=jar:...` by exploiting property binding to access ClassLoader. The vulnerability was fixed in Spring Framework commit 3a5af35d37 (May 2010) by upstream developer Juergen Hoeller. This fix was already present in the upstream Spring Framework 5.3.39 release when TuxCare onboarded it. The target ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.39.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.39.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-28T22:44:11.275398+00:00",
      "status_notes": "Vulnerability CVE-2021-22096 affects version 5.3.39.tuxcare of org.springframework:spring.",
      "vulnerability": {
        "name": "CVE-2021-22096"
      },
      "action_statement": "Vulnerability CVE-2021-22096 affects version 5.3.39.tuxcare of org.springframework:spring."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework/spring@5.3.39.tuxcare",
          "identifiers": {
            "purl": "pkg:maven/org.springframework/spring@5.3.39.tuxcare"
          }
        }
      ],
      "timestamp": "2026-10-29T00:40:33.053070+00:00",
      "status_notes": "Vulnerability CVE-2023-20860 affects version 5.3.39.tuxcare of org.springframework:spring.",
      "vulnerability": {
        "name": "CVE-2023-20860"
      },
      "action_statement": "Vulnerability CVE-2023-20860 affects version 5.3.39.tuxcare of org.springframework:spring."
    }
  ]
}