{ "@id": "urn:uuid:a58043f7-0d9d-4086-90ba-76834dd9d8df", "role": "Document Creator", "author": "https://tuxcare.com", "version": 1, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-20T13:56:00.078920+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2019-3795 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2019-3795" }, "action_statement": "Vulnerability CVE-2019-3795 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2020-5408 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2020-5408" }, "action_statement": "Vulnerability CVE-2020-5408 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2021-22112 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2021-22112" }, "action_statement": "Vulnerability CVE-2021-22112 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2021-22119 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2021-22119" }, "action_statement": "Vulnerability CVE-2021-22119 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2022-22978 is fixed in version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2022-22978" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2022-31690 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2022-31690" }, "action_statement": "Vulnerability CVE-2022-31690 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2023-34042 does not affect version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Target version 5.1.4.RELEASE predates the introduction of the vulnerable code pattern. The world-writable symlink `spring-security.xsd` was only introduced in version 5.7.9 (commit 1eefd433b6), while the target is based on version 5.1.4.RELEASE which predates this by several major/minor versions. The file does not exist in the target repository at all.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-34042" }, "impact_statement": "not_affected \u2014 Target version 5.1.4.RELEASE predates the introduction of the vulnerable code pattern. The world-writable symlink `spring-security.xsd` was only introduced in version 5.7.9 (commit 1eefd433b6), while the target is based on version 5.1.4.RELEASE which predates this by several major/minor versions. The file does not exist in the target repository at all." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2024-22257 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2024-22257" }, "action_statement": "Vulnerability CVE-2024-22257 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2024-38821 is fixed in version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2024-38821" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2024-38827 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2024-38827" }, "action_statement": "Vulnerability CVE-2024-38827 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2025-22228 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2025-22228" }, "action_statement": "Vulnerability CVE-2025-22228 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2025-22234 does not affect version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 CVE-2025-22234 is a timing attack regression introduced by the CVE-2025-22228 fix. The target Spring Security 5.1.4.RELEASE (SHA e659e352de) never received the CVE-2025-22228 backport that added strict password length checking in BCrypt, therefore it does not have the timing attack vulnerability that CVE-2025-22234 addresses. The timing attack mitigation in DaoAuthenticationProvider remains int...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-22234" }, "impact_statement": "not_affected \u2014 CVE-2025-22234 is a timing attack regression introduced by the CVE-2025-22228 fix. The target Spring Security 5.1.4.RELEASE (SHA e659e352de) never received the CVE-2025-22228 backport that added strict password length checking in BCrypt, therefore it does not have the timing attack vulnerability that CVE-2025-22234 addresses. The timing attack mitigation in DaoAuthenticationProvider remains int..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2026-22732 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2026-22732" }, "action_statement": "Vulnerability CVE-2026-22732 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2026-22746 is fixed in version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2026-22746" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2026-22747 is fixed in version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2026-22747" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2026-22748 does not affect version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 5.1.4.RELEASE is not affected by CVE-2026-22748. The vulnerable API pattern (NimbusJwtDecoder.withIssuerLocation and NimbusReactiveJwtDecoder.withIssuerLocation builder methods) does not exist in this version. Version 5.1.4 uses an older API design with NimbusJwtDecoderJwkSupport (constructor-based) and JwtDecoders.fromOidcIssuerLocation() static factory method, which already in...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22748" }, "impact_statement": "not_affected \u2014 Spring Security 5.1.4.RELEASE is not affected by CVE-2026-22748. The vulnerable API pattern (NimbusJwtDecoder.withIssuerLocation and NimbusReactiveJwtDecoder.withIssuerLocation builder methods) does not exist in this version. Version 5.1.4 uses an older API design with NimbusJwtDecoderJwkSupport (constructor-based) and JwtDecoders.fromOidcIssuerLocation() static factory method, which already in..." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2026-22753 does not affect version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. Spring Security 5.1.4.RELEASE is not affected by CVE-2026-22753. The vulnerability exists only in versions 7.0.0-7.0.4 and involves PathPatternRequestMatcher.Builder bean handling and the securityMatchers(String) API. Version 5.1.4.RELEASE predates this architecture entirely\u2014it uses AntPathRequestMatcher, MvcRequestMatcher, and RegexRequestMatcher with a requestMatchers() API (not securityMatchers). The vulnerable classes (HttpSecurityConfiguration, PathPatternRequestMatcherFactoryBean, PathPatternRequestMatcher.Builder) do not exist in this version. The servlet path handling in 5.1.4.RELEASE uses a simple setter pattern in MvcRequestMatcher, completely different from the Builder pattern vulnerability in 7.x.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22753" }, "impact_statement": "Spring Security 5.1.4.RELEASE is not affected by CVE-2026-22753. The vulnerability exists only in versions 7.0.0-7.0.4 and involves PathPatternRequestMatcher.Builder bean handling and the securityMatchers(String) API. Version 5.1.4.RELEASE predates this architecture entirely\u2014it uses AntPathRequestMatcher, MvcRequestMatcher, and RegexRequestMatcher with a requestMatchers() API (not securityMatchers). The vulnerable classes (HttpSecurityConfiguration, PathPatternRequestMatcherFactoryBean, PathPatternRequestMatcher.Builder) do not exist in this version. The servlet path handling in 5.1.4.RELEASE uses a simple setter pattern in MvcRequestMatcher, completely different from the Builder pattern vulnerability in 7.x." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2026-22754 does not affect version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. Spring Security 5.1.4.RELEASE is not affected by CVE-2026-22754. The vulnerability affects versions 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean where the basePath() method's return value was discarded, causing servlet-path configurations to be lost. Version 5.1.4 uses a completely different architecture: MvcRequestMatcher with direct property setters via BeanDefinitionBuilder.addPropertyValue(), which doesn't have this bug. The vulnerable classes (PathPatternRequestMatcherFactoryBean, PathPatternRequestMatcher.Builder) do not exist in 5.1.4. Tests confirm servlet-path works correctly in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22754" }, "impact_statement": "Spring Security 5.1.4.RELEASE is not affected by CVE-2026-22754. The vulnerability affects versions 7.0.0-7.0.4 due to a builder pattern bug in PathPatternRequestMatcherFactoryBean where the basePath() method's return value was discarded, causing servlet-path configurations to be lost. Version 5.1.4 uses a completely different architecture: MvcRequestMatcher with direct property setters via BeanDefinitionBuilder.addPropertyValue(), which doesn't have this bug. The vulnerable classes (PathPatternRequestMatcherFactoryBean, PathPatternRequestMatcher.Builder) do not exist in 5.1.4. Tests confirm servlet-path works correctly in this version." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2026-41706 does not affect version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web. not_affected \u2014 Spring Security 5.1.4.RELEASE is not affected by CVE-2026-41706. The vulnerable classes CookieRequestCache and CookieServerRequestCache do not exist in this version - they were introduced more than a year after 5.1.4.RELEASE was released (February 2019 vs June 2020). The target version uses HttpSessionRequestCache which stores redirect URLs server-side in HttpSession, not in client-controllable...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41706" }, "impact_statement": "not_affected \u2014 Spring Security 5.1.4.RELEASE is not affected by CVE-2026-41706. The vulnerable classes CookieRequestCache and CookieServerRequestCache do not exist in this version - they were introduced more than a year after 5.1.4.RELEASE was released (February 2019 vs June 2020). The target version uses HttpSessionRequestCache which stores redirect URLs server-side in HttpSession, not in client-controllable..." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2026-47838 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2026-47838" }, "action_statement": "Vulnerability CVE-2026-47838 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2026-47842 is fixed in version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2026-47842" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2026-59270 is fixed in version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2026-59270" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.springframework.security/spring-security-web@5.1.4.RELEASE-tuxcare.1" } } ], "timestamp": "2026-10-20T13:56:00.078920+00:00", "status_notes": "Vulnerability CVE-2026-59276 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web.", "vulnerability": { "name": "CVE-2026-59276" }, "action_statement": "Vulnerability CVE-2026-59276 affects version 5.1.4.RELEASE-tuxcare.1 of org.springframework.security:spring-security-web." } ] }