{
  "@id": "urn:uuid:35a2daaa-a2b0-495b-9d11-5fdfd6739442",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-15T18:45:12.712241+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:02:03.517418+00:00",
      "status_notes": "Vulnerability CVE-2023-34034 affects version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap.",
      "vulnerability": {
        "name": "CVE-2023-34034"
      },
      "action_statement": "Vulnerability CVE-2023-34034 affects version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:02:03.517418+00:00",
      "status_notes": "Vulnerability CVE-2023-34042 does not affect version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap. not_affected \u2014 Version 5.6.9 is not affected by CVE-2023-34042. The vulnerability was caused by a symlink file (spring-security.xsd \u2192 spring-security-5.7.xsd) that resulted in world-writable file permissions in the JAR. This symlink was introduced in commit 1eefd433b6 (May 2023), after version 5.6.9 was released. Version 5.6.9 predates the introduction of the symlink and only contains versioned XSD files (spr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-34042"
      },
      "impact_statement": "not_affected \u2014 Version 5.6.9 is not affected by CVE-2023-34042. The vulnerability was caused by a symlink file (spring-security.xsd \u2192 spring-security-5.7.xsd) that resulted in world-writable file permissions in the JAR. This symlink was introduced in commit 1eefd433b6 (May 2023), after version 5.6.9 was released. Version 5.6.9 predates the introduction of the symlink and only contains versioned XSD files (spr..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:02:03.517418+00:00",
      "status_notes": "Vulnerability CVE-2024-22257 affects version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap.",
      "vulnerability": {
        "name": "CVE-2024-22257"
      },
      "action_statement": "Vulnerability CVE-2024-22257 affects version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:08:40.988076+00:00",
      "status_notes": "Vulnerability CVE-2024-38821 is fixed in version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap.",
      "vulnerability": {
        "name": "CVE-2024-38821"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:09:55.233643+00:00",
      "status_notes": "Vulnerability CVE-2024-38827 is fixed in version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap.",
      "vulnerability": {
        "name": "CVE-2024-38827"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:07:43.314211+00:00",
      "status_notes": "Vulnerability CVE-2025-22228 is fixed in version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap.",
      "vulnerability": {
        "name": "CVE-2025-22228"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:02:03.517418+00:00",
      "status_notes": "Vulnerability CVE-2025-22234 does not affect version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap. not_affected \u2014 Version 5.6.9 is not affected by CVE-2025-22234. This CVE describes a timing attack vulnerability that was introduced by the fix for CVE-2025-22228. The CVE-2025-22228 fix added a 72-byte password length check that was enforced during both encoding and verification, creating a timing side-channel. Version 5.6.9 never received the CVE-2025-22228 fix, so the vulnerable pattern (the unconditional ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-22234"
      },
      "impact_statement": "not_affected \u2014 Version 5.6.9 is not affected by CVE-2025-22234. This CVE describes a timing attack vulnerability that was introduced by the fix for CVE-2025-22228. The CVE-2025-22228 fix added a 72-byte password length check that was enforced during both encoding and verification, creating a timing side-channel. Version 5.6.9 never received the CVE-2025-22228 fix, so the vulnerable pattern (the unconditional ..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:08:40.988076+00:00",
      "status_notes": "Vulnerability CVE-2026-22732 is fixed in version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap.",
      "vulnerability": {
        "name": "CVE-2026-22732"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:09:55.233643+00:00",
      "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap.",
      "vulnerability": {
        "name": "CVE-2026-22746"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:08:40.988076+00:00",
      "status_notes": "Vulnerability CVE-2026-22747 is fixed in version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap.",
      "vulnerability": {
        "name": "CVE-2026-22747"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:02:03.517418+00:00",
      "status_notes": "Vulnerability CVE-2026-22748 does not affect version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap. not_affected \u2014 Version 5.6.9 is not affected by CVE-2026-22748. The vulnerability concerns the `NimbusJwtDecoder.withIssuerLocation()` and `NimbusReactiveJwtDecoder.withIssuerLocation()` static builder methods that were misleadingly named (suggesting automatic issuer validation when they provided none). These methods were introduced in Spring Security 6.1.0 (April 2023), approximately 5 months after version 5...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-22748"
      },
      "impact_statement": "not_affected \u2014 Version 5.6.9 is not affected by CVE-2026-22748. The vulnerability concerns the `NimbusJwtDecoder.withIssuerLocation()` and `NimbusReactiveJwtDecoder.withIssuerLocation()` static builder methods that were misleadingly named (suggesting automatic issuer validation when they provided none). These methods were introduced in Spring Security 6.1.0 (April 2023), approximately 5 months after version 5..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:02:03.517418+00:00",
      "status_notes": "Vulnerability CVE-2026-22753 does not affect version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap. Spring Security 5.6.9 is not affected by CVE-2026-22753. The vulnerability requires two components that were introduced AFTER version 5.6.9: (1) the securityMatchers(String) API (added in 5.8.0, September 2022), and (2) PathPatternRequestMatcher.Builder (added in 6.5.x, March 2025). Version 5.6.9 uses an explicit servlet path API (.servletPath() on MvcRequestMatcher) with no automatic bean discovery or builder pattern for request matchers. The vulnerable code pattern cannot manifest in this architecture.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22753"
      },
      "impact_statement": "Spring Security 5.6.9 is not affected by CVE-2026-22753. The vulnerability requires two components that were introduced AFTER version 5.6.9: (1) the securityMatchers(String) API (added in 5.8.0, September 2022), and (2) PathPatternRequestMatcher.Builder (added in 6.5.x, March 2025). Version 5.6.9 uses an explicit servlet path API (.servletPath() on MvcRequestMatcher) with no automatic bean discovery or builder pattern for request matchers. The vulnerable code pattern cannot manifest in this architecture."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:02:03.517418+00:00",
      "status_notes": "Vulnerability CVE-2026-22754 does not affect version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap. CVE-2026-22754 affects Spring Security 7.0.0-7.0.4, which introduced PathPatternRequestMatcherFactoryBean with a builder pattern bug where basePath() return value is discarded. Target version 5.6.9 uses a completely different architecture (MvcRequestMatcher with property setters) that correctly enforces servlet-path authorization rules. The vulnerable code path does not exist in this version.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-22754"
      },
      "impact_statement": "CVE-2026-22754 affects Spring Security 7.0.0-7.0.4, which introduced PathPatternRequestMatcherFactoryBean with a builder pattern bug where basePath() return value is discarded. Target version 5.6.9 uses a completely different architecture (MvcRequestMatcher with property setters) that correctly enforces servlet-path authorization rules. The vulnerable code path does not exist in this version."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:09:55.233643+00:00",
      "status_notes": "Vulnerability CVE-2026-40988 is fixed in version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap.",
      "vulnerability": {
        "name": "CVE-2026-40988"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:02:03.517418+00:00",
      "status_notes": "Vulnerability CVE-2026-40993 does not affect version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap. Spring Security 5.6.9 is not affected by CVE-2026-40993. The vulnerable component JdbcAssertingPartyMetadataRepository does not exist in this version. This class was introduced in Spring Security 7.0.x as a new feature for JDBC-based SAML2 asserting party metadata storage. Version 5.6.9 only contains in-memory SAML2 repositories and has no JDBC-based credential deserialization code paths in the SAML2 module. The vulnerability pattern (insecure deserialization of credentials from database columns) is structurally absent from this codebase version.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40993"
      },
      "impact_statement": "Spring Security 5.6.9 is not affected by CVE-2026-40993. The vulnerable component JdbcAssertingPartyMetadataRepository does not exist in this version. This class was introduced in Spring Security 7.0.x as a new feature for JDBC-based SAML2 asserting party metadata storage. Version 5.6.9 only contains in-memory SAML2 repositories and has no JDBC-based credential deserialization code paths in the SAML2 module. The vulnerability pattern (insecure deserialization of credentials from database columns) is structurally absent from this codebase version."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:09:55.233643+00:00",
      "status_notes": "Vulnerability CVE-2026-41003 is fixed in version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap.",
      "vulnerability": {
        "name": "CVE-2026-41003"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:09:55.233643+00:00",
      "status_notes": "Vulnerability CVE-2026-41694 is fixed in version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap.",
      "vulnerability": {
        "name": "CVE-2026-41694"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:08:40.988076+00:00",
      "status_notes": "Vulnerability CVE-2026-41706 is fixed in version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap.",
      "vulnerability": {
        "name": "CVE-2026-41706"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-07T17:02:03.517418+00:00",
      "status_notes": "Vulnerability CVE-2026-47838 affects version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap.",
      "vulnerability": {
        "name": "CVE-2026-47838"
      },
      "action_statement": "Vulnerability CVE-2026-47838 affects version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T18:45:12.712241+00:00",
      "status_notes": "Vulnerability CVE-2026-47842 affects version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap, and is fixed in 5.6.9-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-47842"
      },
      "action_statement": "Vulnerability CVE-2026-47842 affects version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap, and is fixed in 5.6.9-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T18:45:12.712241+00:00",
      "status_notes": "Vulnerability CVE-2026-59270 affects version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap, and is fixed in 5.6.9-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-59270"
      },
      "action_statement": "Vulnerability CVE-2026-59270 affects version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap, and is fixed in 5.6.9-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-ldap@5.6.9-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-15T18:45:12.712241+00:00",
      "status_notes": "Vulnerability CVE-2026-59276 affects version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap, and is fixed in 5.6.9-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-59276"
      },
      "action_statement": "Vulnerability CVE-2026-59276 affects version 5.6.9-tuxcare.1 of org.springframework.security:spring-security-ldap, and is fixed in 5.6.9-tuxcare.2."
    }
  ]
}